python-pskc-0.5/ 0000755 0000000 0000000 00000000000 13040717606 013577 5 ustar root root 0000000 0000000 python-pskc-0.5/setup.py 0000755 0000000 0000000 00000004621 13040703437 015314 0 ustar root root 0000000 0000000 #!/usr/bin/env python
# setup.py - python-pskc installation script
#
# Copyright (C) 2014-2017 Arthur de Jong
#
# This library is free software; you can redistribute it and/or
# modify it under the terms of the GNU Lesser General Public
# License as published by the Free Software Foundation; either
# version 2.1 of the License, or (at your option) any later version.
#
# This library is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
# Lesser General Public License for more details.
#
# You should have received a copy of the GNU Lesser General Public
# License along with this library; if not, write to the Free Software
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
# 02110-1301 USA
"""python-pskc installation script."""
import os
import sys
from setuptools import setup, find_packages
import pskc
# fix permissions for sdist
if 'sdist' in sys.argv:
os.system('chmod -R a+rX .')
os.umask(int('022', 8))
setup(
name='python-pskc',
version=pskc.__version__,
description='Python module for handling PSKC files',
long_description=pskc.__doc__,
author='Arthur de Jong',
author_email='arthur@arthurdejong.org',
keywords=['PSKC', 'RFC 6030', 'key container'],
url='http://arthurdejong.org/python-pskc/',
license='LGPL',
classifiers=[
'Development Status :: 4 - Beta',
'Intended Audience :: Developers',
'Intended Audience :: Information Technology',
'Intended Audience :: System Administrators',
'License :: OSI Approved :: GNU Lesser General Public License v2 or later (LGPLv2+)',
'Operating System :: OS Independent',
'Programming Language :: Python',
'Programming Language :: Python :: 2',
'Programming Language :: Python :: 2.7',
'Programming Language :: Python :: 3',
'Programming Language :: Python :: 3.4',
'Programming Language :: Python :: 3.5',
'Programming Language :: Python :: 3.6',
'Topic :: Security :: Cryptography',
'Topic :: Software Development :: Libraries :: Python Modules',
'Topic :: System :: Systems Administration :: Authentication/Directory',
'Topic :: Text Processing :: Markup :: XML',
],
packages=find_packages(),
install_requires=['pycrypto', 'python-dateutil'],
)
python-pskc-0.5/tests/ 0000755 0000000 0000000 00000000000 13040717606 014741 5 ustar root root 0000000 0000000 python-pskc-0.5/tests/test_write.doctest 0000644 0000000 0000000 00000044620 13036777211 020532 0 ustar root root 0000000 0000000 test_write.doctest - tests for writing PSKC files
Copyright (C) 2014-2016 Arthur de Jong
This library is free software; you can redistribute it and/or
modify it under the terms of the GNU Lesser General Public
License as published by the Free Software Foundation; either
version 2.1 of the License, or (at your option) any later version.
This library is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
Lesser General Public License for more details.
You should have received a copy of the GNU Lesser General Public
License along with this library; if not, write to the Free Software
Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
02110-1301 USA
>>> from pskc import PSKC
>>> import datetime
>>> import sys
>>> import tempfile
>>> from Crypto import Random
>>> from binascii import a2b_hex
>>> from dateutil.tz import tzutc
Build a PSKC structure.
>>> pskc = PSKC()
Add a key with all attributes set.
>>> key = pskc.add_key(id='456', manufacturer='Manufacturer')
>>> key.id = '123'
>>> key.serial = '987654321'
>>> key.model = 'Model'
>>> key.issue_no = 2
>>> key.start_date = datetime.datetime(2006, 5, 1, 0, 0, tzinfo=tzutc())
>>> key.expiry_date = datetime.datetime(2014, 5, 31, 0, 0, tzinfo=tzutc())
>>> key.device_userid = 'uid=arthur, dc=arthurdejong, dc=org'
>>> key.crypto_module = 'CyrptoId'
>>> key.algorithm = 'urn:ietf:params:xml:ns:keyprov:pskc:hotp'
>>> key.issuer = 'Issuer'
>>> key.key_profile = 'key profile id'
>>> key.key_reference = 'reference to some key'
>>> key.friendly_name = 'a friendly key'
>>> key.key_userid = 'cn=Arthur de Jong, dc=arthurdejong, dc=org'
>>> key.algorithm_suite = 'Clubs'
>>> key.challenge_encoding = 'DECIMAL'
>>> key.challenge_min_length = 6
>>> key.challenge_max_length = 8
>>> key.challenge_check = True
>>> key.response_encoding = 'DECIMAL'
>>> key.response_length = 8
>>> key.response_check = False
>>> key.counter = 0
>>> key.secret = a2b_hex('4e1790ba272406ba309c5a31')
Add policy information and a PIN.
>>> key.policy.key_usage.append('OTP')
>>> key.policy.key_usage.append(key.policy.KEY_USE_VERIFY)
>>> key.policy.start_date = datetime.datetime(2008, 5, 1, 0, 0, tzinfo=tzutc())
>>> key.policy.expiry_date = datetime.datetime(2012, 6, 13, 0, 0, tzinfo=tzutc())
>>> key.policy.number_of_transactions = 42
>>> key.policy.pin_key_id = 'pinID'
>>> key.policy.pin_usage = 'Local'
>>> key.policy.pin_max_failed_attemtps = 3
>>> key.policy.pin_min_length = 4
>>> key.policy.pin_max_length = 4
>>> key.policy.pin_encoding = 'DECIMAL'
>>> pin_key = pskc.add_key(id='pinID', secret='1234',
... algorithm='urn:ietf:params:xml:ns:keyprov:pskc:pin',
... response_encoding='DECIMAL', response_length=4)
Add a second (TOTP) key:
>>> key = pskc.add_key()
>>> key.serial = key.id = '267469811'
>>> key.start_date = datetime.datetime(2006, 5, 1, 0, 0)
>>> key.expiry_date = datetime.datetime(2014, 5, 31, 0, 0)
>>> key.algorithm = 'urn:ietf:params:xml:ns:keyprov:pskc:totp'
>>> key.response_encoding = 'DECIMAL'
>>> key.response_length = 6
>>> key.time_offset = 0
>>> key.time_interval = 30
>>> key.time_drift = 6
>>> key.secret = a2b_hex('4e1790ba272406ba309c5a31')
Write the PSKC file (use temporary file to test passing file name as
argument).
>>> f = tempfile.NamedTemporaryFile()
>>> pskc.write(f.name)
>>> with open(f.name, 'r') as r:
... x = sys.stdout.write(r.read()) #doctest: +REPORT_UDIFF
Manufacturer987654321Model22006-05-01T00:00:00Z2014-05-31T00:00:00Zuid=arthur, dc=arthurdejong, dc=orgCyrptoIdIssuerClubskey profile idreference to some keya friendly keyTheQuickBrownFox0cn=Arthur de Jong, dc=arthurdejong, dc=org2008-05-01T00:00:00Z2012-06-13T00:00:00ZOTPVerify42MTIzNA==2674698112006-05-01T00:00:002014-05-31T00:00:00TheQuickBrownFox0306
Read an encrypted PSKC file and write it out as an unencrypted file.
>>> pskc = PSKC('tests/encryption/kw-aes128.pskcxml')
>>> pskc.encryption.key = a2b_hex('000102030405060708090a0b0c0d0e0f')
>>> for key in pskc.keys:
... key.secret = key.secret # force decryption of values
>>> pskc.encryption.key = None
>>> pskc.encryption.key_name = None
>>> pskc.write(sys.stdout) #doctest: +REPORT_UDIFF
ABEiM0RVZneImaq7zN3u/w==
Read an encrypted PSKC file and write it out as-is. This does not require
providing the encryption key.
>>> pskc = PSKC('tests/rfc6030/figure6.pskcxml')
>>> pskc.write(sys.stdout) #doctest: +REPORT_UDIFF
Pre-shared-keyESIzRFVmd4iZABEiM0RVZgKn6WjLaTC1sbeBMSvIhRejN9vJa2BOlSaMrR7I5wSXManufacturer987654321CM_ID_001IssuerAAECAwQFBgcICQoLDA0OD+cIHItlB3Wra1DUpxVvOx2lef1VmNPCMl8jwZqIUqGvSu+NvtQfmvfJzF6bmQiJqoLRExc=0
Set up an encrypted PSKC file and generate a pre-shared key for it.
>>> pskc = PSKC()
>>> key = pskc.add_key(
... id='1', serial='123456', secret='1234', counter=42)
>>> pskc.encryption.setup_preshared_key(
... algorithm='aes128-cbc',
... key=a2b_hex('12345678901234567890123456789012'),
... key_name='Pre-shared KEY', fields = ['secret', 'counter'])
>>> f = tempfile.NamedTemporaryFile()
>>> pskc.write(f.name)
>>> with open(f.name, 'r') as r:
... x = sys.stdout.write(r.read()) #doctest: +ELLIPSIS +REPORT_UDIFF
Pre-shared KEY...123456............
Read the generated file back in and verify that it matches the original data.
>>> newpskc = PSKC(f.name)
>>> newpskc.encryption.algorithm == pskc.encryption.algorithm
True
>>> newpskc.encryption.key = pskc.encryption.key
>>> all(newkey.check() for newkey in newpskc.keys)
True
>>> key = pskc.keys[0]
>>> newkey = newpskc.keys[0]
>>> newkey.secret == key.secret
True
>>> newkey.counter == key.counter
True
Use PBKDF2 to derive a key instead of using a pre-shared key.
>>> pskc = PSKC()
>>> key = pskc.add_key(
... id='1', serial='123456', secret='1234', counter=42)
>>> pskc.encryption.setup_pbkdf2(
... 'passphrase', key_name='Passphrase')
>>> pskc.write(sys.stdout) #doctest: +ELLIPSIS +REPORT_UDIFF
...1200016Passphrase...123456......42
Test encryption and decryption of the generated file to test encryption/
decryption combinations.
>>> def test_algorithm(algorithm):
... f = tempfile.NamedTemporaryFile()
... pskc1 = PSKC()
... pskc1.add_key(secret=Random.get_random_bytes(16))
... pskc1.encryption.setup_preshared_key(algorithm=algorithm)
... pskc1.write(f.name)
... pskc2 = PSKC(f.name)
... pskc2.encryption.key = pskc1.encryption.key
... assert pskc1.keys[0].secret == pskc2.keys[0].secret
... return (pskc1, pskc2)
>>> pskc1, pskc2 = test_algorithm('aes192-cbc')
>>> len(pskc1.encryption.key)
24
>>> pskc1, pskc2 = test_algorithm('aes256-cbc')
>>> len(pskc1.encryption.key)
32
>>> pskc1, pskc2 = test_algorithm('tripledes-cbc')
>>> len(pskc1.encryption.key)
24
>>> pskc1, pskc2 = test_algorithm('kw-aes128')
>>> len(pskc1.encryption.key)
16
>>> pskc1, pskc2 = test_algorithm('kw-aes192')
>>> len(pskc1.encryption.key)
24
>>> pskc1, pskc2 = test_algorithm('kw-aes256')
>>> len(pskc1.encryption.key)
32
>>> pskc1, pskc2 = test_algorithm('kw-tripledes')
>>> len(pskc1.encryption.key)
24
Not having a key and trying encryption will fail.
>>> f = tempfile.NamedTemporaryFile()
>>> pskc = PSKC()
>>> key = pskc.add_key(secret='1234')
>>> pskc.encryption.setup_preshared_key()
>>> pskc.encryption.key = None
>>> pskc.write(f.name)
Traceback (most recent call last):
...
EncryptionError: No key available
>>> pskc = PSKC()
>>> key = pskc.add_key(secret='1234')
>>> pskc.encryption.setup_preshared_key()
>>> pskc.encryption.algorithm = None
>>> pskc.write(f.name)
Traceback (most recent call last):
...
EncryptionError: No algorithm specified
>>> pskc = PSKC()
>>> key = pskc.add_key(secret='1234')
>>> pskc.encryption.setup_preshared_key()
>>> pskc.encryption.algorithm = 'FOOBAR'
>>> pskc.write(f.name)
Traceback (most recent call last):
...
DecryptionError: Unsupported algorithm: 'FOOBAR'
>>> pskc = PSKC()
>>> key = pskc.add_key(secret='1234')
>>> pskc.encryption.setup_preshared_key()
>>> pskc.encryption.algorithm = 'aes256-cbc'
>>> pskc.write(f.name)
Traceback (most recent call last):
...
EncryptionError: Invalid key length
Setting up something else than PBKDF2 as derivation algorithm will just
result in an empty KeyDerivation element.
>>> pskc = PSKC()
>>> key = pskc.add_key(secret='1234')
>>> pskc.encryption.setup_pbkdf2('qwerty')
>>> pskc.encryption.derivation.algorithm = 'unknown'
>>> pskc.write(sys.stdout) #doctest: +ELLIPSIS +REPORT_UDIFF
...
...
We can make the PKKDF2 salt have to be transmitted out-of-bounds:
>>> pskc = PSKC()
>>> key = pskc.add_key(secret='1234')
>>> pskc.encryption.setup_pbkdf2('qwerty', salt=a2b_hex('1234567890'))
>>> pskc.encryption.derivation.pbkdf2_salt = None
>>> pskc.write(sys.stdout) #doctest: +ELLIPSIS +REPORT_UDIFF
1200016
...
...
Write a PSKC file with two keys in onde KeyPackage section. Note that this
is not allowed in the RFC 6030 schema. Note that device properties that are
set on one key end up being applied to both keys.
>>> pskc = PSKC()
>>> device = pskc.add_device(manufacturer='TokenVendorAcme')
>>> key = device.add_key(id='1', serial='123456', secret='1234', counter=42)
>>> key = device.add_key(id='pin0', secret='5678')
>>> pskc.write(sys.stdout) #doctest: +ELLIPSIS +REPORT_UDIFF
TokenVendorAcme123456MTIzNA==42NTY3OA==
python-pskc-0.5/tests/test_misc.doctest 0000644 0000000 0000000 00000015374 13036777211 020337 0 ustar root root 0000000 0000000 test_misc.doctest - miscellaneous tests
Copyright (C) 2014-2016 Arthur de Jong
This library is free software; you can redistribute it and/or
modify it under the terms of the GNU Lesser General Public
License as published by the Free Software Foundation; either
version 2.1 of the License, or (at your option) any later version.
This library is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
Lesser General Public License for more details.
You should have received a copy of the GNU Lesser General Public
License along with this library; if not, write to the Free Software
Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
02110-1301 USA
>>> from binascii import a2b_hex, b2a_hex
>>> def tostr(x):
... return str(x.decode())
>>> def decode(f):
... return lambda x: tostr(f(x))
>>> b2a_hex = decode(b2a_hex)
>>> import datetime
>>> now = datetime.datetime(2016, 3, 23, 0, 0, 0)
>>> import dateutil.tz
>>> from pskc import PSKC
This tests the most minimal valid PSKC file with one empty key.
>>> try:
... from StringIO import StringIO
... except ImportError:
... from io import StringIO
>>> minimal_pskc = StringIO('''
...
...
...
...
... '''.strip())
>>> pskc = PSKC(minimal_pskc)
>>> len(pskc.keys)
0
>>> len(pskc.devices)
1
Check creation of empty PSKC structure and adding an empty key to the list.
>>> pskc = PSKC()
>>> key = pskc.add_key(id='123')
>>> key.id
'123'
>>> key.secret is None
True
We can also put device-specific properties in a device:
>>> pskc = PSKC()
>>> device = pskc.add_device(manufacturer='Tokens INC.')
>>> len(pskc.keys)
0
>>> key = device.add_key(id='123', serial='456')
>>> len(pskc.keys)
1
>>> key.id
'123'
>>> key.manufacturer
'Tokens INC.'
>>> device.serial
'456'
Adding a key or device with unknown attributes raises an error.
>>> key = pskc.add_key(foo='bar') # doctest: +IGNORE_EXCEPTION_DETAIL
Traceback (most recent call last):
...
AttributeError
>>> device.add_key(foo='bar') # doctest: +IGNORE_EXCEPTION_DETAIL
Traceback (most recent call last):
...
AttributeError
>>> device = pskc.add_device(foo='bar') # doctest: +IGNORE_EXCEPTION_DETAIL
Traceback (most recent call last):
...
AttributeError
Setting secret, counter, etc. also works
>>> key = pskc.add_key(secret='VERYSECRET')
>>> key.counter = 10
>>> key.secret
'VERYSECRET'
>>> key.counter
10
Setting encryption key name and algorithm also works.
>>> pskc.encryption.key_name = 'Test encryption key'
>>> pskc.encryption.key_names
['Test encryption key']
>>> pskc.encryption.algorithm is None
True
>>> pskc.encryption.algorithm = 'aes128-cbc'
>>> pskc.encryption.algorithm
'http://www.w3.org/2001/04/xmlenc#aes128-cbc'
>>> pskc.encryption.algorithm_key_lengths
[16]
>>> pskc.encryption.algorithm = '3des-cbc'
>>> pskc.encryption.algorithm
'http://www.w3.org/2001/04/xmlenc#tripledes-cbc'
>>> pskc.encryption.algorithm_key_lengths
[16, 24]
>>> pskc.encryption.algorithm = 'none'
>>> pskc.encryption.algorithm is None
True
>>> pskc.encryption.algorithm_key_lengths # doctest: +IGNORE_EXCEPTION_DETAIL
Traceback (most recent call last):
...
DecryptionError: No algorithm specified
Load an PSKC file with an odd namespace.
>>> pskc = PSKC('tests/misc/odd-namespace.pskcxml')
>>> pskc.version
'1.0'
>>> pskc.id
'exampleID1'
>>> key = pskc.keys[0]
>>> key.id
'12345678'
>>> key.issuer
'Issuer-A'
>>> tostr(key.secret)
'1234'
Load a PSKC file that uses the xenc11 namespace for the PBKDF2 parameters.
>>> pskc = PSKC('tests/misc/SampleFullyQualifiedNS.xml')
>>> pskc.encryption.key_name
'PassPhrase'
>>> pskc.encryption.derive_key('3FCA3158035072D6')
>>> key = pskc.keys[0]
>>> b2a_hex(key.secret)
'09fbecfd0bf47910839e2eb05ffa10b95cd0390950ce32ab790583ed134171e0'
>>> key.check()
True
Empty PSKC files should raise a useful exception when trying to derive an
encryption key from a password.
>>> pskc = PSKC()
>>> pskc.encryption.derive_key('123456') # doctest: +IGNORE_EXCEPTION_DETAIL
Traceback (most recent call last):
...
KeyDerivationError: No algorithm specified
Integers can be represented in different ways in PSKC files.
>>> pskc = PSKC('tests/misc/integers.pskcxml')
>>> pskc.encryption.key = a2b_hex('12345678901234567890123456789012')
>>> [key.counter for key in pskc.keys]
[831791, 709791, 405834, 298507, 961392]
This tests key policy and unknown policy elements. The first key should have
all known policy elements set while other keys should have extra unknown
information added which should result in rejected usage.
>>> pskc = PSKC('tests/misc/policy.pskcxml')
>>> key = pskc.keys[0]
>>> key.policy.start_date
datetime.datetime(2006, 5, 1, 0, 0, tzinfo=tzutc())
>>> key.policy.expiry_date
datetime.datetime(2026, 5, 31, 0, 0, tzinfo=tzutc())
>>> key.policy.number_of_transactions
4321
>>> key.policy.key_usage
['OTP']
>>> key.policy.unknown_policy_elements
False
>>> key.policy.may_use()
True
>>> key.policy.may_use('OTP', datetime.datetime(2005, 4, 3, 0, 0, 0))
False
>>> key.policy.may_use('OTP', now)
True
>>> key.policy.may_use('OTP', datetime.datetime(2028, 12, 31, 0, 0, 0))
False
>>> key.policy.start_date = datetime.datetime.now() + \
... datetime.timedelta(seconds=10)
>>> key.policy.may_use('OTP')
False
>>> key.policy.start_date = datetime.datetime.now(dateutil.tz.tzlocal()) - \
... datetime.timedelta(seconds=10)
>>> key.policy.may_use('OTP')
True
>>> key = pskc.keys[1]
>>> key.policy.key_usage
['OTP']
>>> key.policy.unknown_policy_elements
True
>>> key.policy.may_use('OTP', now)
False
>>> key.policy.pin
'1234'
>>> key = pskc.keys[2]
>>> key.policy.key_usage
['OTP']
>>> key.policy.unknown_policy_elements
True
>>> key.policy.may_use('OTP', now)
False
>>> key.policy.pin is None
True
>>> key = pskc.keys[3]
>>> key.policy.key_usage
['OTP']
>>> key.policy.unknown_policy_elements
True
>>> key.policy.may_use('OTP', now)
False
>>> key.policy.pin is None
True
This checks the ChallengeFormat and ResponseFormat handling of keys and
specifically the attribute indicating presence of check digits.
>>> pskc = PSKC('tests/misc/checkdigits.pskcxml')
>>> for key in pskc.keys:
... print('challenge %r %r %r %r' % (
... key.challenge_encoding, key.challenge_min_length,
... key.challenge_max_length, key.challenge_check))
... print('response %r %r %r' % (
... key.response_encoding, key.response_length,
... key.response_check)) #doctest: +REPORT_UDIFF
challenge 'DECIMAL' 12 34 True
response 'DECIMAL' 8 False
challenge 'DECIMAL' 56 78 False
response 'DECIMAL' 9 True
challenge 'DECIMAL' 16 87 False
response 'DECIMAL' 3 True
challenge 'HEXADECIMAL' 4 6 None
response 'ALPHANUMERIC' 6 None
python-pskc-0.5/tests/test_tripledeskw.doctest 0000644 0000000 0000000 00000005260 12676003033 021723 0 ustar root root 0000000 0000000 test_tripledeskw.doctest - test keywrap functions
Copyright (C) 2014-2016 Arthur de Jong
This library is free software; you can redistribute it and/or
modify it under the terms of the GNU Lesser General Public
License as published by the Free Software Foundation; either
version 2.1 of the License, or (at your option) any later version.
This library is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
Lesser General Public License for more details.
You should have received a copy of the GNU Lesser General Public
License along with this library; if not, write to the Free Software
Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
02110-1301 USA
>>> import re
>>> from binascii import a2b_hex
>>> from pskc.crypto.tripledeskw import wrap, unwrap
>>> def fromhex(value):
... return a2b_hex(re.sub(r'\s', '', value))
Example from RFC 3217 section 3.2 wrapping a 192 bit Triple DES key with
another 192 bit Triple DES key.
>>> plaintext = fromhex('''
... 2923 bf85 e06d d6ae 5291 49f1 f1ba e9ea b3a7 da3d 860d 3e98
... ''')
>>> key = fromhex('''
... 255e 0d1c 07b6 46df b313 4cc8 43ba 8aa7 1f02 5b7c 0838 251f
... ''')
>>> iv = fromhex('5dd4 cbfc 96f5 453b')
>>> ciphertext = fromhex('''
... 6901 0761 8ef0 92b3 b48c a179 6b23 4ae9 fa33 ebb4 1596 0403
... 7db5 d6a8 4eb3 aac2 768c 6327 75a4 67d4
... ''')
>>> wrap(plaintext, key, iv=iv) == ciphertext
True
>>> unwrap(ciphertext, key) == plaintext
True
Leaving out the iv ensures that a random iv is used.
>>> c = wrap(plaintext, key)
>>> c == ciphertext
False
>>> unwrap(c, key) == plaintext
True
Wrapping is only specified for Triple DES keys but the algorithms works for
any plaintext that is a multiple of the Triple DES block size but fails
otherwise.
>>> short_plaintext = fromhex('''
... 2923 bf85 e06d d6ae 5291 49f1 f1ba e9ea
... ''')
>>> unwrap(wrap(short_plaintext, key), key) == short_plaintext
True
>>> short_plaintext = fromhex('''
... 2923 bf85 e06d d6ae 5291 49f1 f1ba e9
... ''')
>>> wrap(short_plaintext, key) # doctest: +IGNORE_EXCEPTION_DETAIL
Traceback (most recent call last):
...
EncryptionError: Plaintext length wrong
The ciphertext must have the correct length (multiple of Triple DES block
size) and unwrapping is also authenticated.
>>> unwrap(ciphertext, key) == plaintext
True
>>> unwrap(ciphertext[:-1], key) # doctest: +IGNORE_EXCEPTION_DETAIL
Traceback (most recent call last):
...
DecryptionError: Ciphertext length wrong
>>> unwrap(ciphertext[:-1] + b'A', key) # doctest: +IGNORE_EXCEPTION_DETAIL
Traceback (most recent call last):
...
DecryptionError: CMS key checksum error
python-pskc-0.5/tests/nagraid/ 0000755 0000000 0000000 00000000000 13040717606 016346 5 ustar root root 0000000 0000000 python-pskc-0.5/tests/nagraid/file1.pskcxml 0000644 0000000 0000000 00000007623 12676003033 020755 0 ustar root root 0000000 0000000
Pre-shared-keyOdudVkgsZywiwE1HqPGOJtHmBl+6HzJkylgDrZU9gcflyCddzO+cxEwzYIlOiwrENagraID Security306EUO4-00960306E880479B6A2CA2080OCRA-1:HOTP-SHA1-6:C-QN08-PSHA1VHdEP8TXnMmE3yiAnB5Fx+SQ85UXCNAxH7IyOixJpUZHMk9GTdFYWNsxZp8jVpfpuQ1Bef+XVXHQoW4ZzyQ/cv/9zYA=0NagraID Security306EUO4-00954306E880489CFA2CA2080OCRA-1:HOTP-SHA1-6:C-QN08-PSHA1YTvA1cSntb4cPJHPFkJwuSZkAsLPo+o1EJPA22DeijZRaKhJAwArQKbwDwSmNrR1N8QGRQ7yKd8suyUgaEVme7f0HrA=0NagraID Security306EUO4-00958306E880497B3A2CA2080OCRA-1:HOTP-SHA1-6:C-QN08-PSHA1BdxW7Pb46LafGV8k2zDQ48ujoyYX7M+JumfS3Wx5dP1E9y5By/97QTMiGkzJrcWjWGhmLhbGn4Dksa7lHKfKOqbsJhU=0
python-pskc-0.5/tests/test_nagraid.doctest 0000644 0000000 0000000 00000003376 13037001220 020765 0 ustar root root 0000000 0000000 test_vendors.doctest - tests for NagraID PSKC files
Copyright (C) 2016 Arthur de Jong
This library is free software; you can redistribute it and/or
modify it under the terms of the GNU Lesser General Public
License as published by the Free Software Foundation; either
version 2.1 of the License, or (at your option) any later version.
This library is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
Lesser General Public License for more details.
You should have received a copy of the GNU Lesser General Public
License along with this library; if not, write to the Free Software
Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
02110-1301 USA
>>> from binascii import a2b_hex, b2a_hex
>>> def tostr(x):
... return str(x.decode())
>>> def decode(f):
... return lambda x: tostr(f(x))
>>> b2a_hex = decode(b2a_hex)
>>> from pskc import PSKC
This tests a simple PSKC file from NagraID which is protected by a pre-shared
key. The file contains three OCRA keys.
>>> pskc = PSKC('tests/nagraid/file1.pskcxml')
>>> print('\n'.join(key.serial for key in pskc.keys)) #doctest: +REPORT_UDIFF
306EUO4-00960
306EUO4-00954
306EUO4-00958
>>> key = pskc.keys[0]
>>> bool(key.secret) # doctest: +IGNORE_EXCEPTION_DETAIL
Traceback (most recent call last):
...
DecryptionError: No key available
>>> pskc.encryption.key_name
'Pre-shared-key'
>>> pskc.encryption.key = a2b_hex('4A057F6AB6FCB57AB5408E46A9835E68')
>>> bool(key.secret)
True
>>> key.check()
True
>>> print('\n'.join(key.algorithm_suite for key in pskc.keys)) #doctest: +REPORT_UDIFF
OCRA-1:HOTP-SHA1-6:C-QN08-PSHA1
OCRA-1:HOTP-SHA1-6:C-QN08-PSHA1
OCRA-1:HOTP-SHA1-6:C-QN08-PSHA1
python-pskc-0.5/tests/draft-hoyer-keyprov-pskc-algorithm-profiles-01/ 0000755 0000000 0000000 00000000000 13040717606 025643 5 ustar root root 0000000 0000000 python-pskc-0.5/tests/draft-hoyer-keyprov-pskc-algorithm-profiles-01/securid-aes-counter.pskcxml 0000644 0000000 0000000 00000002116 13035526505 033127 0 ustar root root 0000000 0000000
RSA, The Security Division of EMC123456798Issuer2006-04-14T00:00:00Z2010-09-30T00:00:00ZMTIzNDU2Nzg5MDEyMzQ1Njc4OTA=
0
python-pskc-0.5/tests/draft-hoyer-keyprov-pskc-algorithm-profiles-01/totp.pskcxml 0000644 0000000 0000000 00000002252 13035526505 030235 0 ustar root root 0000000 0000000
TokenVendorAcme987654323Issuer
MTIzNDU2Nzg5MDEyMzQ1Njc4OTA=
304
python-pskc-0.5/tests/draft-hoyer-keyprov-pskc-algorithm-profiles-01/ocra.pskcxml 0000644 0000000 0000000 00000002010 13035526505 030163 0 ustar root root 0000000 0000000
TokenVendorAcme987654322IssuerMTIzNDU2Nzg5MDEyMzQ1Njc4OTA=0
python-pskc-0.5/tests/draft-hoyer-keyprov-pskc-algorithm-profiles-01/actividentity-3des.pskcxml 0000644 0000000 0000000 00000002447 13036777211 032774 0 ustar root root 0000000 0000000
ActivIdentity34567890Issuer
MTIzNDU2Nzg5MDEyMzQ1Njc4OTA=
0320
python-pskc-0.5/tests/yubico/ 0000755 0000000 0000000 00000000000 13040717606 016233 5 ustar root root 0000000 0000000 python-pskc-0.5/tests/yubico/example3.pskcxml 0000644 0000000 0000000 00000002755 13037001220 021345 0 ustar root root 0000000 0000000
oath.UB2835972009-01-22T00:25:09Z1ACME Inc.
K34VFiiu0qar9xWICc9PPA==
CN=ekhgjhbctrgn, UID=ca62baca62ba
python-pskc-0.5/tests/yubico/example1.pskcxml 0000644 0000000 0000000 00000002167 13037001220 021340 0 ustar root root 0000000 0000000
oath.UB2835992009-01-22T00:25:11Z1ACME Inc.
K34VFiiu0qar9xWICc9PPA==
CN=ekhgjhbctrgn, UID=ca62baca62ba
python-pskc-0.5/tests/yubico/example2.pskcxml 0000644 0000000 0000000 00000003271 13037001220 021336 0 ustar root root 0000000 0000000
oath.UB2835982009-01-22T00:25:10Z1ACME Inc.
Vpg1bTCGjEIB4m9mxYK7RQ==
CN=ekhgjhbctrgn, UID=ca62baca62baoath.UB2835982009-01-22T00:25:10Z2ACME Inc.
OIkrgqvxgHeIRY/FpRZcgA==
CN=ekhgjhbctrgn, UID=ca62baca62ba
python-pskc-0.5/tests/test_feitian.doctest 0000644 0000000 0000000 00000005207 13037001220 020772 0 ustar root root 0000000 0000000 test_feitian.doctest - tests for Feitian PSKC files
Copyright (C) 2016 Arthur de Jong
This library is free software; you can redistribute it and/or
modify it under the terms of the GNU Lesser General Public
License as published by the Free Software Foundation; either
version 2.1 of the License, or (at your option) any later version.
This library is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
Lesser General Public License for more details.
You should have received a copy of the GNU Lesser General Public
License along with this library; if not, write to the Free Software
Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
02110-1301 USA
>>> from binascii import a2b_hex, b2a_hex
>>> def tostr(x):
... return str(x.decode())
>>> def decode(f):
... return lambda x: tostr(f(x))
>>> b2a_hex = decode(b2a_hex)
>>> from pskc import PSKC
This tests a simple non-encrypted PSKC file from Feitian. The PSKC file
contains two HOTP keys and four TOTP keys.
>>> pskc = PSKC('tests/feitian/file1.pskcxml')
>>> pskc.keys[0].manufacturer
'Feitian Technology Co.,Ltd'
>>> print('\n'.join(key.serial for key in pskc.keys)) #doctest: +REPORT_UDIFF
1000133508267
1000133508255
2600124809778
2600124809787
2600135004012
2600135004013
>>> print('\n'.join(key.algorithm for key in pskc.keys)) #doctest: +REPORT_UDIFF
urn:ietf:params:xml:ns:keyprov:pskc:hotp
urn:ietf:params:xml:ns:keyprov:pskc:hotp
urn:ietf:params:xml:ns:keyprov:pskc:totp
urn:ietf:params:xml:ns:keyprov:pskc:totp
urn:ietf:params:xml:ns:keyprov:pskc:totp
urn:ietf:params:xml:ns:keyprov:pskc:totp
>>> pskc.keys[5].time_interval
60
This tests a sample seed file originally provided by GOOZE for Feitian
c100 / c200 hardware tokens. There is one TOTP key and one HTOP key in
the file.
>>> pskc = PSKC('tests/feitian/20120919-test001-4282.xml')
>>> pskc.keys[0].manufacturer
'FeiTian Technology Co.,Ltd'
>>> print('\n'.join(key.serial for key in pskc.keys))
2600215704919
1000117803294
>>> key = pskc.keys[0]
>>> key.algorithm, key.response_length, key.time_offset, key.time_interval
('urn:ietf:params:xml:ns:keyprov:pskc:totp', 6, 0, 60)
>>> key.policy.start_date
datetime.datetime(2012, 9, 19, 0, 0, tzinfo=tzutc())
>>> key.policy.expiry_date
datetime.datetime(2022, 9, 1, 0, 0, tzinfo=tzutc())
>>> key = pskc.keys[1]
>>> key.algorithm, key.response_length, key.counter
('urn:ietf:params:xml:ns:keyprov:pskc:hotp', 6, 0)
>>> key.policy.start_date
datetime.datetime(2012, 9, 19, 0, 0, tzinfo=tzutc())
>>> key.policy.expiry_date
datetime.datetime(2022, 9, 1, 0, 0, tzinfo=tzutc())
python-pskc-0.5/tests/test_encryption.doctest 0000644 0000000 0000000 00000020616 13036777211 021571 0 ustar root root 0000000 0000000 test_encryption.doctest - test various encryption schemes
Copyright (C) 2014-2016 Arthur de Jong
This library is free software; you can redistribute it and/or
modify it under the terms of the GNU Lesser General Public
License as published by the Free Software Foundation; either
version 2.1 of the License, or (at your option) any later version.
This library is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
Lesser General Public License for more details.
You should have received a copy of the GNU Lesser General Public
License along with this library; if not, write to the Free Software
Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
02110-1301 USA
>>> from binascii import a2b_hex, b2a_hex
>>> def tostr(x):
... return str(x.decode())
>>> def decode(f):
... return lambda x: tostr(f(x))
>>> b2a_hex = decode(b2a_hex)
>>> import base64
>>> from pskc import PSKC
>>> from pskc.encryption import encrypt, decrypt
>>> pskc = PSKC('tests/encryption/aes128-cbc.pskcxml')
>>> pskc.encryption.key = a2b_hex('12345678901234567890123456789012')
>>> pskc.encryption.algorithm
'http://www.w3.org/2001/04/xmlenc#aes128-cbc'
>>> tostr(pskc.keys[0].secret)
'12345678901234567890'
>>> pskc.mac.algorithm
'http://www.w3.org/2001/04/xmldsig-more#hmac-sha224'
>>> tostr(pskc.mac.key)
'MacMacMacMacMacMacMa'
>>> pskc = PSKC('tests/encryption/aes192-cbc.pskcxml')
>>> pskc.encryption.key = a2b_hex('12345678901234567890123456789012')
>>> pskc.encryption.algorithm
'http://www.w3.org/2001/04/xmlenc#aes192-cbc'
>>> pskc.keys[0].secret # doctest: +IGNORE_EXCEPTION_DETAIL
Traceback (most recent call last):
...
DecryptionError: Invalid key length
>>> pskc.encryption.key = a2b_hex('123456789012345678901234567890123456789012345678')
>>> tostr(pskc.keys[0].secret)
'12345678901234567890'
>>> pskc.mac.algorithm
'http://www.w3.org/2001/04/xmldsig-more#hmac-sha256'
>>> tostr(pskc.mac.key)
'MacMacMacMacMacMacMa'
>>> pskc = PSKC('tests/encryption/aes256-cbc.pskcxml')
>>> pskc.encryption.key = a2b_hex('1234567890123456789012345678901234567890123456789012345678901234')
>>> pskc.encryption.algorithm
'http://www.w3.org/2001/04/xmlenc#aes256-cbc'
>>> tostr(pskc.keys[0].secret)
'12345678901234567890'
>>> pskc.mac.algorithm
'http://www.w3.org/2001/04/xmldsig-more#hmac-sha384'
>>> tostr(pskc.mac.key)
'MacMacMacMacMacMacMa'
>>> pskc = PSKC('tests/encryption/tripledes-cbc.pskcxml')
>>> pskc.encryption.key = a2b_hex('1234')
>>> pskc.keys[0].secret # doctest: +IGNORE_EXCEPTION_DETAIL
Traceback (most recent call last):
...
DecryptionError: Invalid key length
>>> pskc.encryption.key = a2b_hex('12345678901234567890123456789012')
>>> tostr(pskc.keys[0].secret)
'12345678901234567890'
>>> pskc.mac.algorithm
'http://www.w3.org/2001/04/xmldsig-more#hmac-sha512'
>>> tostr(pskc.mac.key)
'MacMacMacMacMacMacMa'
>>> pskc = PSKC('tests/encryption/kw-aes128.pskcxml')
>>> pskc.encryption.key = a2b_hex('1234')
>>> pskc.keys[0].secret # doctest: +IGNORE_EXCEPTION_DETAIL
Traceback (most recent call last):
...
DecryptionError: Invalid key length
>>> pskc.encryption.key = a2b_hex('000102030405060708090a0b0c0d0e0f')
>>> b2a_hex(pskc.keys[0].secret)
'00112233445566778899aabbccddeeff'
>>> pskc = PSKC('tests/encryption/kw-aes192.pskcxml')
>>> pskc.encryption.key = a2b_hex('000102030405060708090a0b0c0d0e0f')
>>> pskc.keys[0].secret # doctest: +IGNORE_EXCEPTION_DETAIL
Traceback (most recent call last):
...
DecryptionError: Invalid key length
>>> pskc.encryption.key = a2b_hex('000102030405060708090a0b0c0d0e0f1011121314151617')
>>> b2a_hex(pskc.keys[0].secret)
'00112233445566778899aabbccddeeff'
>>> pskc = PSKC('tests/encryption/kw-aes256.pskcxml')
>>> pskc.encryption.key = a2b_hex('000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f')
>>> b2a_hex(pskc.keys[0].secret)
'00112233445566778899aabbccddeeff0001020304050607'
>>> pskc = PSKC('tests/encryption/kw-tripledes.pskcxml')
>>> pskc.encryption.key = a2b_hex('255e0d1c07b646dfb3134cc843ba8aa71f')
>>> pskc.keys[0].secret # doctest: +IGNORE_EXCEPTION_DETAIL
Traceback (most recent call last):
...
DecryptionError: Invalid key length
>>> pskc.encryption.key = a2b_hex('255e0d1c07b646dfb3134cc843ba8aa71f025b7c0838251f')
>>> b2a_hex(pskc.keys[0].secret)
'2923bf85e06dd6ae529149f1f1bae9eab3a7da3d860d3e98'
The IV can also be specified globally.
>>> pskc = PSKC('tests/encryption/aes128-cbc-noiv.pskcxml')
>>> pskc.encryption.key = a2b_hex('12345678901234567890123456789012')
>>> pskc.encryption.iv = a2b_hex('000102030405060708090a0b0c0d0e0f')
>>> tostr(pskc.keys[0].secret)
'12345678901234567890'
>>> tostr(pskc.mac.key)
'MacMacMacMacMacMacMa'
If the PSKC file does not have a MAC key configured, older versions of the
PSKC format allowed using the encryption key for the HMAC function.
>>> pskc = PSKC('tests/encryption/no-mac-key.pskcxml')
>>> pskc.encryption.key = a2b_hex('12345678901234567890123456789012')
>>> b2a_hex(pskc.mac.key)
'12345678901234567890123456789012'
>>> tostr(pskc.keys[0].secret)
'12345678901234567890'
Older versions of the PSKC format allowed having the MAC go over the
plaintext instead of the ciphertext.
>>> pskc = PSKC('tests/encryption/mac-over-plaintext.pskcxml')
>>> pskc.encryption.key = a2b_hex('12345678901234567890123456789012')
>>> tostr(pskc.keys[0].secret)
'12345678901234567890'
Test decryption with tripledes-cbc and a specified IV.
>>> iv = a2b_hex('1010101010101010')
>>> key = a2b_hex('12345678901234567890123456789012')
>>> ciphertext = encrypt('#tripledes-cbc', key, b'FOOBAR', iv)
>>> ciphertext = ciphertext[8:] # strip IV
>>> tostr(decrypt('#tripledes-cbc', key, ciphertext, iv))
'FOOBAR'
>>> tostr(decrypt('#tripledes-cbc', key, iv + ciphertext))
'FOOBAR'
MAC key and algorithm will use useful defaults but can also be manually
specified.
>>> pskc = PSKC()
>>> pskc.mac.setup()
>>> pskc.mac.algorithm
'http://www.w3.org/2000/09/xmldsig#hmac-sha1'
>>> len(pskc.mac.key)
20
>>> pskc.mac.setup(key=a2b_hex('548512684595'), algorithm='unknown')
>>> pskc.mac.algorithm
'unknown'
>>> len(pskc.mac.key)
6
>>> pskc.mac.algorithm_key_length # this is the default
16
>>> pskc.mac.algorithm = None
>>> pskc.mac.key = None
>>> pskc.mac.setup(algorithm='hmac-sha224')
>>> pskc.mac.algorithm
'http://www.w3.org/2001/04/xmldsig-more#hmac-sha224'
>>> pskc.mac.algorithm_key_length
28
>>> len(pskc.mac.key)
28
Test PBKDF2 key derivation set-up. Only specifying a passphrase picks
reasonable defaults.
>>> pskc = PSKC()
>>> pskc.encryption.setup_pbkdf2('test')
>>> pskc.encryption.derivation.algorithm
'http://www.rsasecurity.com/rsalabs/pkcs/schemas/pkcs-5v2-0#pbkdf2'
>>> pskc.encryption.derivation.pbkdf2_iterations
12000
>>> len(pskc.encryption.derivation.pbkdf2_salt)
16
>>> pskc.encryption.derivation.pbkdf2_key_length
16
>>> pskc.encryption.algorithm
'http://www.w3.org/2001/04/xmlenc#aes128-cbc'
>>> len(pskc.encryption.key)
16
The function will pick up an pre-specified values. If an encryption algorithm
is defined (can also be passed) the key with the correct size will be
generated.
>>> pskc = PSKC()
>>> pskc.encryption.algorithm = 'aes256-cbc'
>>> pskc.encryption.derivation.pbkdf2_iterations = 15000
>>> pskc.encryption.setup_pbkdf2('test')
>>> pskc.encryption.derivation.algorithm
'http://www.rsasecurity.com/rsalabs/pkcs/schemas/pkcs-5v2-0#pbkdf2'
>>> pskc.encryption.derivation.pbkdf2_iterations
15000
>>> len(pskc.encryption.derivation.pbkdf2_salt)
16
>>> pskc.encryption.derivation.pbkdf2_key_length
32
>>> pskc.encryption.algorithm
'http://www.w3.org/2001/04/xmlenc#aes256-cbc'
>>> len(pskc.encryption.key)
32
All properties can also be manually specified.
>>> pskc = PSKC()
>>> pskc.encryption.setup_pbkdf2(
... 'qwerty', iterations=1000, algorithm='aes256-cbc', key_length=24,
... salt=base64.b64decode('Ej7/PEpyEpw='),
... key_name='PBKDF2 passphrase',
... prf='hmac-md5')
>>> pskc.encryption.derivation.algorithm
'http://www.rsasecurity.com/rsalabs/pkcs/schemas/pkcs-5v2-0#pbkdf2'
>>> pskc.encryption.derivation.pbkdf2_iterations
1000
>>> b2a_hex(pskc.encryption.derivation.pbkdf2_salt)
'123eff3c4a72129c'
>>> pskc.encryption.derivation.pbkdf2_key_length
24
>>> pskc.encryption.derivation.pbkdf2_prf
'http://www.w3.org/2001/04/xmldsig-more#hmac-md5'
>>> pskc.encryption.algorithm
'http://www.w3.org/2001/04/xmlenc#aes256-cbc'
>>> pskc.encryption.key_name
'PBKDF2 passphrase'
>>> b2a_hex(pskc.encryption.key)
'e8c5fecfb2a5cbb80ff791782ff5e125cc375bb6ba113071'
python-pskc-0.5/tests/test_invalid.doctest 0000644 0000000 0000000 00000014724 13037001215 021011 0 ustar root root 0000000 0000000 test_invalid.doctest - test for invalid PSKC file
Copyright (C) 2014-2016 Arthur de Jong
This library is free software; you can redistribute it and/or
modify it under the terms of the GNU Lesser General Public
License as published by the Free Software Foundation; either
version 2.1 of the License, or (at your option) any later version.
This library is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
Lesser General Public License for more details.
You should have received a copy of the GNU Lesser General Public
License along with this library; if not, write to the Free Software
Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
02110-1301 USA
>>> from binascii import a2b_hex, b2a_hex
>>> def tostr(x):
... return str(x.decode())
>>> def decode(f):
... return lambda x: tostr(f(x))
>>> b2a_hex = decode(b2a_hex)
>>> from pskc import PSKC
Load a number of invalid files.
This file is plain invalid XML.
>>> pskc = PSKC('tests/invalid/notxml.pskcxml') # doctest: +IGNORE_EXCEPTION_DETAIL
Traceback (most recent call last):
...
ParseError: Error parsing XML
This XML file has a wrong top-level element.
>>> pskc = PSKC('tests/invalid/wrongelement.pskcxml') # doctest: +IGNORE_EXCEPTION_DETAIL
Traceback (most recent call last):
...
ParseError: Missing KeyContainer
This file has an unknown PSKC version.
>>> pskc = PSKC('tests/invalid/wrongversion.pskcxml') # doctest: +IGNORE_EXCEPTION_DETAIL
Traceback (most recent call last):
...
ParseError: Unsupported version
This PSKC file has a key with an unknown algorithm specified.
>>> pskc = PSKC('tests/invalid/unknown-encryption.pskcxml')
>>> key = pskc.keys[0]
>>> key.id
'12345678'
>>> key.secret # doctest: +IGNORE_EXCEPTION_DETAIL
Traceback (most recent call last):
...
DecryptionError: No key available
>>> pskc.encryption.key = a2b_hex('12345678901234567890123456789012')
>>> key.secret # doctest: +IGNORE_EXCEPTION_DETAIL
Traceback (most recent call last):
...
DecryptionError: Unsupported algorithm: ...
This PSKC file has a key without an algorithm specified.
>>> pskc = PSKC('tests/invalid/missing-encryption.pskcxml')
>>> pskc.encryption.key = a2b_hex('12345678901234567890123456789012')
>>> key = pskc.keys[0]
>>> key.id
'45678901'
>>> b2a_hex(key.secret) # doctest: +IGNORE_EXCEPTION_DETAIL
Traceback (most recent call last):
...
DecryptionError: No algorithm specified
>>> pskc.encryption.algorithm = 'aes128-cbc'
>>> b2a_hex(key.secret)
'3132333435363738393031323334353637383930'
This PSKC file has a key without an encryption method specified.
>>> pskc = PSKC('tests/invalid/missing-encryption-method.pskcxml')
>>> pskc.encryption.key = a2b_hex('12345678901234567890123456789012')
>>> key = pskc.keys[0]
>>> key.id
'45678901'
>>> b2a_hex(key.secret) # doctest: +IGNORE_EXCEPTION_DETAIL
Traceback (most recent call last):
...
DecryptionError: No algorithm specified
>>> pskc.encryption.algorithm = 'aes128-cbc'
>>> b2a_hex(key.secret)
'3132333435363738393031323334353637383930'
This PSKC file has an incomplete key derivation configuration.
>>> pskc = PSKC('tests/invalid/incomplete-derivation.pskcxml')
>>> pskc.encryption.derive_key('qwerty') # doctest: +IGNORE_EXCEPTION_DETAIL
Traceback (most recent call last):
...
KeyDerivationError: Incomplete PBKDF2 configuration
Specify an unknown key derivation algorithm.
>>> pskc = PSKC('tests/rfc6030/figure7.pskcxml')
>>> pskc.encryption.derivation.algorithm = 'unknown'
>>> pskc.encryption.derive_key('qwerty') # doctest: +IGNORE_EXCEPTION_DETAIL
Traceback (most recent call last):
...
KeyDerivationError: Unsupported algorithm: 'unknown'
Figure 6 does use encryption but with a pre-shared key. Attempting key
derivation with such a PSKC file should result in an exception.
>>> pskc = PSKC('tests/rfc6030/figure6.pskcxml')
>>> pskc.encryption.derive_key('qwerty') # doctest: +IGNORE_EXCEPTION_DETAIL
Traceback (most recent call last):
...
KeyDerivationError: No algorithm specified
Specify an unknown PBKDF2 PRF (pseudorandom function).
>>> pskc = PSKC('tests/rfc6030/figure7.pskcxml')
>>> pskc.encryption.derivation.pbkdf2_prf = 'unknown'
>>> pskc.encryption.derive_key('qwerty') # doctest: +IGNORE_EXCEPTION_DETAIL
Traceback (most recent call last):
...
KeyDerivationError: Pseudorandom function unsupported: 'unknown'
There is a ValueMAC element but no MACMethod element.
>>> pskc = PSKC('tests/invalid/no-mac-method.pskcxml')
>>> pskc.encryption.key = a2b_hex('12345678901234567890123456789012')
>>> pskc.encryption.algorithm
'http://www.w3.org/2001/04/xmlenc#aes128-cbc'
>>> pskc.mac.algorithm is None
True
>>> key = pskc.keys[0]
>>> key.id
'12345678'
>>> key.secret # doctest: +IGNORE_EXCEPTION_DETAIL
Traceback (most recent call last):
...
DecryptionError: No MAC algorithm set
There is an unknown algorithm specified in MACMethod.
>>> pskc = PSKC('tests/invalid/mac-algorithm.pskcxml')
>>> pskc.encryption.key = a2b_hex('12345678901234567890123456789012')
>>> key = pskc.keys[0]
>>> key.id
'12345678'
>>> key.secret # doctest: +IGNORE_EXCEPTION_DETAIL
Traceback (most recent call last):
...
DecryptionError: Unsupported MAC algorithm: ...
The MAC value does not match the calculated MAC, something was modified in
transit.
>>> pskc = PSKC('tests/invalid/mac-value.pskcxml')
>>> pskc.encryption.key = a2b_hex('12345678901234567890123456789012')
>>> pskc.encryption.algorithm
'http://www.w3.org/2001/04/xmlenc#aes128-cbc'
>>> pskc.mac.algorithm
'http://www.w3.org/2000/09/xmldsig#hmac-sha1'
>>> key = pskc.keys[0]
>>> key.id
'12345678'
>>> key.secret # doctest: +IGNORE_EXCEPTION_DETAIL
Traceback (most recent call last):
...
DecryptionError: MAC value does not match
>>> key.check() # doctest: +IGNORE_EXCEPTION_DETAIL
Traceback (most recent call last):
...
DecryptionError: MAC value does not match
Checks to see that invalid values are detected.
>>> pskc = PSKC('tests/invalid/not-integer.pskcxml') # doctest: +IGNORE_EXCEPTION_DETAIL
Traceback (most recent call last):
...
ValueError: invalid literal for int() with base 10: 'TWELVE'
>>> pskc = PSKC('tests/invalid/not-integer2.pskcxml') # doctest: +IGNORE_EXCEPTION_DETAIL
Traceback (most recent call last):
...
ValueError: invalid literal for int() with base 10: 'FOUR'
>>> pskc = PSKC('tests/invalid/not-boolean.pskcxml') # doctest: +IGNORE_EXCEPTION_DETAIL
Traceback (most recent call last):
...
ValueError: invalid boolean value: 'not really'
python-pskc-0.5/tests/feitian/ 0000755 0000000 0000000 00000000000 13040717606 016360 5 ustar root root 0000000 0000000 python-pskc-0.5/tests/feitian/20120919-test001-4282.xml 0000644 0000000 0000000 00000003306 12676003033 021602 0 ustar root root 0000000 0000000
FeiTian Technology Co.,Ltd2600215704919zSK3gP/9LVNpaAfs039ATa45MnA=602012-09-19T00:00:00Z2022-09-01T00:00:00ZFeiTian Technology Co.,Ltd1000117803294TfpfT+8Jn9s6FYNIySi+uzXkIi0=02012-09-19T00:00:00Z2022-09-01T00:00:00Z
python-pskc-0.5/tests/feitian/file1.pskcxml 0000644 0000000 0000000 00000011251 12676003033 020757 0 ustar root root 0000000 0000000
Feitian Technology Co.,Ltd1000133508267PuMnCivln/14Ii3DNhR4/1zGN5A=02012-08-01T00:00:00Z2037-12-31T00:00:00ZFeitian Technology Co.,Ltd1000133508255wRjcslncyKj//L1oaDVQbAvCNnI=02012-08-01T00:00:00Z2037-12-31T00:00:00ZFeitian Technology Co.,Ltd2600124809778MRffGnGNJKmo8uSW313HCvGNIYM=602012-08-01T00:00:00Z2037-12-31T00:00:00ZFeitian Technology Co.,Ltd26001248097879O9PX9g20x74kIcaLLrGiwMUReM=602012-08-01T00:00:00Z2037-12-31T00:00:00ZFeitian Technology Co.,Ltd2600135004012A0DxFX1zRVTsxJlMKFsDXuNQYcI=602012-08-01T00:00:00Z2037-12-31T00:00:00ZFeitian Technology Co.,Ltd2600135004013NSLuCF/qeQPsqY7Sod4anJMjIBg=602012-08-01T00:00:00Z2037-12-31T00:00:00Z
python-pskc-0.5/tests/test_rfc6030.doctest 0000644 0000000 0000000 00000017300 13036777211 020456 0 ustar root root 0000000 0000000 test_rfc6030.doctest - test for examples from RFC 6030
Copyright (C) 2014-2016 Arthur de Jong
This library is free software; you can redistribute it and/or
modify it under the terms of the GNU Lesser General Public
License as published by the Free Software Foundation; either
version 2.1 of the License, or (at your option) any later version.
This library is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
Lesser General Public License for more details.
You should have received a copy of the GNU Lesser General Public
License along with this library; if not, write to the Free Software
Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
02110-1301 USA
>>> from binascii import a2b_hex, b2a_hex
>>> def tostr(x):
... return str(x.decode())
>>> def decode(f):
... return lambda x: tostr(f(x))
>>> b2a_hex = decode(b2a_hex)
>>> import datetime
>>> now = datetime.datetime(2016, 3, 23, 0, 0, 0)
>>> from pskc import PSKC
This tests figure 2 from RFC 6030. It is a basic key container example with a
simple plain text secret key.
>>> pskc = PSKC('tests/rfc6030/figure2.pskcxml')
>>> [tostr(key.secret) for key in pskc.keys]
['1234']
>>> key = pskc.keys[0]
>>> key.id
'12345678'
>>> key.algorithm
'urn:ietf:params:xml:ns:keyprov:pskc:hotp'
>>> key.issuer
'Issuer-A'
>>> tostr(key.secret)
'1234'
This tests figure 3 from RFC 6030. Relative to figure 2 this includes device,
cryptographic module and user identification as well as some more parameters.
>>> pskc = PSKC('tests/rfc6030/figure3.pskcxml')
>>> pskc.id
'exampleID1'
>>> key = pskc.keys[0]
>>> key.manufacturer
'Manufacturer'
>>> key.serial
'987654321'
>>> key.device_userid
'DC=example-bank,DC=net'
>>> key.crypto_module
'CM_ID_001'
>>> key.id
'12345678'
>>> key.algorithm
'urn:ietf:params:xml:ns:keyprov:pskc:hotp'
>>> key.issuer
'Issuer'
>>> key.response_encoding
'DECIMAL'
>>> key.response_length
8
>>> tostr(key.secret)
'12345678901234567890'
>>> key.counter
0
>>> key.key_userid
'UID=jsmith,DC=example-bank,DC=net'
This tests figure 4 from RFC 6030. In this case the key value itself is not
contained but can be derived using the serial and out-of-band agreements on
the meanings of key_profile and key_reference.
>>> pskc = PSKC('tests/rfc6030/figure4.pskcxml')
>>> key = pskc.keys[0]
>>> key.serial
'987654321'
>>> key.key_profile
'keyProfile1'
>>> key.key_reference
'MasterKeyLabel'
>>> key.counter
0
This tests the key policy properties as illustrated in figure 5 of RFC 6030.
>>> pskc = PSKC('tests/rfc6030/figure5.pskcxml')
>>> len(pskc.keys)
2
>>> key1, key2 = pskc.keys
>>> key1.serial
'987654321'
>>> key.algorithm
'urn:ietf:params:xml:ns:keyprov:pskc:hotp'
>>> key.response_length
8
>>> key.response_encoding
'DECIMAL'
>>> tostr(key1.secret)
'12345678901234567890'
>>> key1.counter
0
>>> key1.policy.pin_min_length
4
>>> key1.policy.pin_max_length
4
>>> key1.policy.pin_key_id
'123456781'
>>> key1.policy.pin_encoding
'DECIMAL'
>>> key1.policy.pin_usage
'Local'
>>> key1.policy.key_usage
['OTP']
>>> key1.policy.may_use('OTP', now)
True
>>> key1.policy.may_use('Encrypt', now)
False
>>> key1.policy.unknown_policy_elements
False
>>> key2.id
'123456781'
>>> key2.serial
'987654321'
>>> key2.algorithm
'urn:ietf:params:xml:ns:keyprov:pskc:pin'
>>> key2.response_length
4
>>> key2.response_encoding
'DECIMAL'
>>> tostr(key2.secret)
'1234'
>>> key1.policy.pin
'1234'
This tests key encryption based on pre-shared keys as illustrated in figure 6
of RFC 6030. The first attempt at extracting the key will fail due to the
encryption.
>>> pskc = PSKC('tests/rfc6030/figure6.pskcxml')
>>> key = pskc.keys[0]
>>> key.id
'12345678'
>>> key.secret # doctest: +IGNORE_EXCEPTION_DETAIL
Traceback (most recent call last):
...
DecryptionError: No key available
>>> pskc.encryption.key_name
'Pre-shared-key'
>>> pskc.encryption.key = a2b_hex('12345678901234567890123456789012')
>>> pskc.encryption.algorithm
'http://www.w3.org/2001/04/xmlenc#aes128-cbc'
>>> b2a_hex(pskc.mac.key)
'1122334455667788990011223344556677889900'
>>> pskc.mac.algorithm
'http://www.w3.org/2000/09/xmldsig#hmac-sha1'
>>> b2a_hex(key.secret)
'3132333435363738393031323334353637383930'
>>> key.check()
True
>>> key.algorithm
'urn:ietf:params:xml:ns:keyprov:pskc:hotp'
>>> key.response_length
8
>>> key.manufacturer
'Manufacturer'
This tests a derived master key using PBKDF2 as seen in figure 7 of RFC 6030.
>>> pskc = PSKC('tests/rfc6030/figure7.pskcxml')
>>> pskc.encryption.key_name
'My Password 1'
>>> pskc.encryption.derive_key('qwerty')
>>> b2a_hex(pskc.encryption.key)
'651e63cd57008476af1ff6422cd02e41'
>>> pskc.encryption.algorithm
'http://www.w3.org/2001/04/xmlenc#aes128-cbc'
>>> b2a_hex(pskc.mac.key)
'bdaab8d648e850d25a3289364f7d7eaaf53ce581'
>>> pskc.mac.algorithm
'http://www.w3.org/2000/09/xmldsig#hmac-sha1'
>>> key = pskc.keys[0]
>>> tostr(key.secret)
'12345678901234567890'
>>> key.check()
True
>>> key.algorithm
'urn:ietf:params:xml:ns:keyprov:pskc:hotp'
>>> key.response_length
8
>>> key.manufacturer
'TokenVendorAcme'
This tests a PSKC file that uses asymmetric encryption as seen in figure 8 of
RFC 6030. Note thet python-pskc does not yet support asymmetric encryption so
this test is really limited.
>>> pskc = PSKC('tests/rfc6030/figure8.pskcxml')
>>> pskc.id
'KC0001'
>>> pskc.encryption.algorithm
'http://www.w3.org/2001/04/xmlenc#rsa_1_5'
>>> key = pskc.keys[0]
>>> key.manufacturer
'TokenVendorAcme'
>>> key.serial
'987654321'
>>> key.id
'MBK000000001'
>>> key.algorithm
'urn:ietf:params:xml:ns:keyprov:pskc:hotp'
>>> key.issuer
'Example-Issuer'
>>> key.response_encoding
'DECIMAL'
>>> key.response_length
6
>>> tostr(key.secret) # doctest: +IGNORE_EXCEPTION_DETAIL
Traceback (most recent call last):
...
DecryptionError: No key available
>>> key.counter
0
This tests a PSKC file that uses digital signature to sign the PSKC file as
seen in figure 8 of RFC 6030. Note that python-pskc currently does not yet
support checking this signature so this test is very limited.
>>> pskc = PSKC('tests/rfc6030/figure9.pskcxml')
>>> key = pskc.keys[0]
>>> key.manufacturer
'TokenVendorAcme'
>>> key.serial
'0755225266'
>>> key.id
'123'
>>> key.algorithm
'urn:ietf:params:xml:ns:keyprov:pskc:hotp'
>>> key.issuer
'Example-Issuer'
>>> key.response_encoding
'DECIMAL'
>>> key.response_length
6
>>> tostr(key.secret)
'12345678901234567890'
>>> key.counter
0
This tests bulk provisioning as shown in figure 10 of RFC 6030.
>>> pskc = PSKC('tests/rfc6030/figure10.pskcxml')
>>> all(key.manufacturer == 'TokenVendorAcme' for key in pskc.keys)
True
>>> [key.serial for key in pskc.keys]
['654321', '123456', '9999999', '9999999']
>>> all(key.algorithm == 'urn:ietf:params:xml:ns:keyprov:pskc:hotp' for key in pskc.keys)
True
>>> all(key.issuer == 'Issuer' for key in pskc.keys)
True
>>> all(key.response_length == 8 for key in pskc.keys)
True
>>> all(key.response_encoding == 'DECIMAL' for key in pskc.keys)
True
>>> all(key.secret == b'12345678901234567890' for key in pskc.keys)
True
>>> all(key.counter == 0 for key in pskc.keys)
True
>>> pskc.keys[0].policy.start_date
datetime.datetime(2006, 5, 1, 0, 0, tzinfo=tzutc())
>>> pskc.keys[0].policy.expiry_date
datetime.datetime(2006, 5, 31, 0, 0, tzinfo=tzutc())
>>> pskc.keys[1].policy.start_date
datetime.datetime(2006, 5, 1, 0, 0, tzinfo=tzutc())
>>> pskc.keys[1].policy.expiry_date
datetime.datetime(2006, 5, 31, 0, 0, tzinfo=tzutc())
>>> pskc.keys[2].policy.start_date
datetime.datetime(2006, 3, 1, 0, 0, tzinfo=tzutc())
>>> pskc.keys[2].policy.expiry_date
datetime.datetime(2006, 3, 31, 0, 0, tzinfo=tzutc())
>>> pskc.keys[3].policy.start_date
datetime.datetime(2006, 4, 1, 0, 0, tzinfo=tzutc())
>>> pskc.keys[3].policy.expiry_date
datetime.datetime(2006, 4, 30, 0, 0, tzinfo=tzutc())
python-pskc-0.5/tests/encryption/ 0000755 0000000 0000000 00000000000 13040717606 017133 5 ustar root root 0000000 0000000 python-pskc-0.5/tests/encryption/tripledes-cbc.pskcxml 0000644 0000000 0000000 00000002305 12676002045 023254 0 ustar root root 0000000 0000000
Pre-shared-keySVZJVklWSVbkU3i5koQy9wRwmtLzydqFV18QfbCMBR8=SVYxMjM0NTbvR25//t5tAuWfL+6ma90GGESqe3AlrJM=4eM8sZbswb+q4q4qZ18q2Af5LEIzZy4M1Mz7XF6Gnc8KozCp87ykK10uOHZpdKLrc9j8Yz0dw9CtQUVcijQKgA==
python-pskc-0.5/tests/encryption/aes192-cbc.pskcxml 0000644 0000000 0000000 00000002310 12676002045 022261 0 ustar root root 0000000 0000000
Pre-shared-keySVZJVklWSVZJVklWSVZJVmDaimFqjBwo8MSWUGmwDkqJvsb1xlkf0MHfyqeooZzMAAECAwQFBgcICQoLDA0OD/616ab2do/xcWNKuW1qE3rSzwqoZcpg5ucwpjiZ07tVADfYOligu/3jDK9QhUGO7gGMxNxmrBUy4qtv4HyKF8o=
python-pskc-0.5/tests/encryption/aes128-cbc.pskcxml 0000644 0000000 0000000 00000002264 12676002045 022270 0 ustar root root 0000000 0000000
Pre-shared-keySVZJVklWSVZJVklWSVZJViZS3d+rzbWqD74OQPuyiwrD+XlDXK7ef602mwOebfTRAAECAwQFBgcICQoLDA0OD+cIHItlB3Wra1DUpxVvOx2lef1VmNPCMl8jwZqIUqGvCjGsEXpmZYGMyejd8WJdLFRBWE9XGJLiigPObg==
python-pskc-0.5/tests/encryption/mac-over-plaintext.pskcxml 0000644 0000000 0000000 00000002401 13036777211 024255 0 ustar root root 0000000 0000000
Pre-shared-keySVZJVklWSVZJVklWSVZJViZS3d+rzbWqD74OQPuyiwrD+XlDXK7ef602mwOebfTRAAECAwQFBgcICQoLDA0OD+cIHItlB3Wra1DUpxVvOx2lef1VmNPCMl8jwZqIUqGvRDATcSJh3n8TAvMDoPzKqobgOCPZSluA7Gmvpg==
python-pskc-0.5/tests/encryption/kw-aes128.pskcxml 0000644 0000000 0000000 00000001463 12676002045 022162 0 ustar root root 0000000 0000000
Pre-shared-keyH6aLCoEStEeu80vY+1p7gp0+hiNx0s/l
python-pskc-0.5/tests/encryption/kw-aes256.pskcxml 0000644 0000000 0000000 00000001544 12676002045 022164 0 ustar root root 0000000 0000000
Pre-shared-keyqPm8FhLGiz/25vT74w5x5Haci4CjLLiVjNXRfWslTaE=
python-pskc-0.5/tests/encryption/kw-aes192.pskcxml 0000644 0000000 0000000 00000001470 12676002045 022161 0 ustar root root 0000000 0000000
Pre-shared-keylneLJa5spDX5K1uXwFCu0kaKuKF62E5d
python-pskc-0.5/tests/encryption/aes256-cbc.pskcxml 0000644 0000000 0000000 00000002354 12676002045 022272 0 ustar root root 0000000 0000000
Pre-shared-keySVZJVklWSVZJVklWSVZJVlAHw4GN7cbXseMBjNjUCrR8Lb4syW0I7bbNZbCBRt7TAAECAwQFBgcICQoLDA0OD7mg24krBXvsLMVBhZbLXDVFEWhqNqRTCO8AfowoBFcdJdB5+Ub/VSapUmJq+ZzEbseBPijlOp6BGy3+AAHoM7x17MbqR77xREby+9/65UOG
python-pskc-0.5/tests/encryption/kw-tripledes.pskcxml 0000644 0000000 0000000 00000001576 12676002045 023157 0 ustar root root 0000000 0000000
Pre-shared-keyaQEHYY7wkrO0jKF5ayNK6foz67QVlgQDfbXWqE6zqsJ2jGMndaRn1A==
python-pskc-0.5/tests/encryption/no-mac-key.pskcxml 0000644 0000000 0000000 00000001754 12767245644 022522 0 ustar root root 0000000 0000000
Pre-shared-keyAAECAwQFBgcICQoLDA0OD+cIHItlB3Wra1DUpxVvOx2lef1VmNPCMl8jwZqIUqGvN8Agsfe5A7WQFswmdvL/MHdd3y0=
python-pskc-0.5/tests/encryption/aes128-cbc-noiv.pskcxml 0000644 0000000 0000000 00000002263 12767245644 023257 0 ustar root root 0000000 0000000
Pre-shared-keyDiahu/VzjP5IbRYxRgNYT+YQcIa03s5FLMnHjTM0rSQ=5wgci2UHdatrUNSnFW87HaV5/VWY08IyXyPBmohSoa8=mNUFNm7a8VqhdmoYDX95B/V7HY36hHOKr6F9jQ==
python-pskc-0.5/tests/test_draft_ietf_keyprov_pskc_02.doctest 0000644 0000000 0000000 00000017362 13036777211 024612 0 ustar root root 0000000 0000000 test_draft_ietf_keyprov_pskc_02.doctest - test for examples from
draft-ietf-keyprov-pskc-02
Copyright (C) 2016 Arthur de Jong
This library is free software; you can redistribute it and/or
modify it under the terms of the GNU Lesser General Public
License as published by the Free Software Foundation; either
version 2.1 of the License, or (at your option) any later version.
This library is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
Lesser General Public License for more details.
You should have received a copy of the GNU Lesser General Public
License along with this library; if not, write to the Free Software
Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
02110-1301 USA
>>> from binascii import a2b_hex, b2a_hex
>>> def tostr(x):
... return str(x.decode())
>>> def decode(f):
... return lambda x: tostr(f(x))
>>> b2a_hex = decode(b2a_hex)
>>> from pskc import PSKC
This tests figure 2 from draft-ietf-keyprov-pskc-02. It is a basic key
container example with a simple plain text secret key.
>>> pskc = PSKC('tests/draft-ietf-keyprov-pskc-02/figure2.pskcxml')
>>> pskc.id
'exampleID1'
>>> key = pskc.keys[0]
>>> key.id
'12345678'
>>> key.manufacturer
'Manufacturer'
>>> key.serial
'987654321'
>>> key.algorithm
'urn:ietf:params:xml:ns:keyprov:pskc#hotp'
>>> key.issuer
'Issuer'
>>> key.response_encoding
'DECIMAL'
>>> key.response_length
8
>>> tostr(key.secret)
'12345678901234567890'
>>> key.counter
0
This tests figure 3 from draft-ietf-keyprov-pskc-02. It is a basic key
container example with a non-encrypted HOTP secret key protected by a PIN
with some extra policy elements.
>>> pskc = PSKC('tests/draft-ietf-keyprov-pskc-02/figure3.pskcxml')
>>> pskc.id
'exampleID1'
>>> device = pskc.devices[0]
>>> device.manufacturer
'Manufacturer'
>>> device.serial
'987654321'
>>> key = pskc.keys[0]
>>> key.id
'12345678'
>>> key.algorithm
'urn:ietf:params:xml:ns:keyprov:pskc#hotp'
>>> key.issuer
'Issuer'
>>> key.response_encoding
'DECIMAL'
>>> key.response_length
8
>>> tostr(key.secret)
'12345678901234567890'
>>> key.counter
0
>>> key.policy.pin_min_length
4
>>> key.policy.pin_max_length
4
>>> key.policy.pin_encoding
'DECIMAL'
>>> key.policy.pin_usage
'Local'
>>> key.policy.key_usage
['OTP']
>>> pinkey = key.policy.pin_key
>>> pinkey == pskc.keys[1]
True
>>> pinkey.id
'123456781'
>>> pinkey.algorithm
'urn:ietf:params:xml:ns:keyprov:pskc#pin'
>>> pinkey.issuer
'Issuer'
>>> pinkey.response_encoding
'DECIMAL'
>>> pinkey.response_length
4
>>> tostr(pinkey.secret)
'1234'
This tests figure 4 from draft-ietf-keyprov-pskc-02. It is a basic key
container example using a AES-128-CBC encrypted pre-shared secret key.
>>> pskc = PSKC('tests/draft-ietf-keyprov-pskc-02/figure4.pskcxml')
>>> pskc.encryption.key_name
'Pre-shared-key'
>>> pskc.encryption.algorithm
'http://www.w3.org/2001/04/xmlenc#aes128-cbc'
>>> pskc.mac.algorithm
'http://www.w3.org/2000/09/xmldsig#hmac-sha1'
>>> key = pskc.keys[0]
>>> key.manufacturer
'Manufacturer'
>>> key.serial
'987654321'
>>> key.id
'12345678'
>>> key.algorithm
'urn:ietf:params:xml:ns:keyprov:pskc#hotp'
>>> key.issuer
'Issuer'
>>> key.response_encoding
'DECIMAL'
>>> key.response_length
8
>>> key.counter
0
>>> b2a_hex(key.secret) # doctest: +IGNORE_EXCEPTION_DETAIL
Traceback (most recent call last):
...
DecryptionError: No key available
>>> pskc.encryption.key = a2b_hex('12345678901234567890123456789012')
>>> b2a_hex(key.secret)
'3132333435363738393031323334353637383930'
This tests figure 5 from draft-ietf-keyprov-pskc-02 which uses an encryption
key that is derived from a passphrase. While the PSKC file contains a
element, there is no MAC algorithm specified anywhere.
>>> pskc = PSKC('tests/draft-ietf-keyprov-pskc-02/figure5.pskcxml')
>>> pskc.encryption.key_name
'Passphrase1'
>>> pskc.encryption.algorithm
'http://www.w3.org/2001/04/xmlenc#aes128-cbc'
>>> key = pskc.keys[0]
>>> key.manufacturer
'TokenVendorAcme'
>>> key.serial
'987654321'
>>> key.id
'123456'
>>> key.algorithm
'urn:ietf:params:xml:ns:keyprov:pskc#hotp'
>>> key.issuer
'Example-Issuer'
>>> key.response_encoding
'DECIMAL'
>>> key.response_length
8
>>> tostr(key.secret) # doctest: +IGNORE_EXCEPTION_DETAIL
Traceback (most recent call last):
...
DecryptionError: No key available
>>> pskc.encryption.derive_key('qwerty')
>>> b2a_hex(pskc.encryption.key)
'651e63cd57008476af1ff6422cd02e41'
>>> tostr(key.secret)
'12345678901234567890'
This tests figure 6 from draft-ietf-keyprov-pskc-02 which uses an encryption
based on asymmetric keys. Note that python-pskc does not yet support
asymmetric encryption so this test is really limited.
>>> pskc = PSKC('tests/draft-ietf-keyprov-pskc-02/figure6.pskcxml')
>>> pskc.id
'KC0001'
>>> pskc.encryption.algorithm
'http://www.w3.org/2001/04/xmlenc#rsa_1_5'
>>> pskc.mac.algorithm
'http://www.w3.org/2000/09/xmldsig#hmac-sha1'
>>> key = pskc.keys[0]
>>> key.manufacturer
'TokenVendorAcme'
>>> key.serial
'987654321'
>>> key.id
'MBK000000001'
>>> key.algorithm
'urn:ietf:params:xml:ns:keyprov:pskc#hotp'
>>> key.issuer
'Example-Issuer'
>>> key.response_encoding
'DECIMAL'
>>> key.response_length
6
>>> tostr(key.secret) # doctest: +IGNORE_EXCEPTION_DETAIL
Traceback (most recent call last):
...
DecryptionError: No key available
>>> key.counter
0
This tests figure 7 from draft-ietf-keyprov-pskc-02 which uses a reference to
an external mechanism to construct a HOTP key.
>>> pskc = PSKC('tests/draft-ietf-keyprov-pskc-02/figure7.pskcxml')
>>> pskc.id
'exampleID1'
>>> key = pskc.keys[0]
>>> key.manufacturer
'Manufacturer'
>>> key.serial
'987654321'
>>> key.id
'12345678'
>>> key.algorithm
'urn:ietf:params:xml:ns:keyprov:pskc#hotp'
>>> key.issuer
'Issuer'
>>> key.response_encoding
'DECIMAL'
>>> key.response_length
8
>>> key.key_profile
'keyProfile1'
>>> key.key_reference
'MasterKeyLabel'
>>> key.counter
0
>>> key.policy.key_usage
['OTP']
This tests figure 8 from draft-ietf-keyprov-pskc-02 which uses a a digital
signature to sign the PSKC file. Note that python-pskc currently does not yet
support checking this signature so this test is very limited.
>>> pskc = PSKC('tests/draft-ietf-keyprov-pskc-02/figure8.pskcxml')
>>> key = pskc.keys[0]
>>> key.manufacturer
'TokenVendorAcme'
>>> key.serial
'0755225266'
>>> key.id
'123'
>>> key.algorithm
'urn:ietf:params:xml:ns:keyprov:pskc#hotp'
>>> key.issuer
'Example-Issuer'
>>> key.response_encoding
'DECIMAL'
>>> key.response_length
6
>>> tostr(key.secret)
'12345678901234567890'
>>> key.counter
0
This tests figure 9 from draft-ietf-keyprov-pskc-02 which contains multiple
devices and keys.
>>> pskc = PSKC('tests/draft-ietf-keyprov-pskc-02/figure9.pskcxml')
>>> [device.manufacturer for device in pskc.devices]
['TokenVendorAcme', 'TokenVendorAcme', 'TokenVendorAcme']
>>> [device.serial for device in pskc.devices]
['654321', '123456', '9999999']
>>> [len(device.keys) for device in pskc.devices]
[1, 1, 2]
>>> [key.id for key in pskc.keys]
['1', '2', '3', '4']
>>> all(key.algorithm.endswith('#hotp') for key in pskc.keys)
True
>>> [key.issuer for key in pskc.keys]
['Issuer', 'Issuer', 'Issuer', 'Issuer']
>>> [bool(key.secret) for key in pskc.keys]
[True, True, True, True]
>>> [key.counter for key in pskc.keys]
[0, 0, 0, 0]
>>> pskc.keys[0].policy.start_date
datetime.datetime(2006, 5, 1, 0, 0, tzinfo=tzutc())
>>> pskc.keys[0].policy.expiry_date
datetime.datetime(2006, 5, 31, 0, 0, tzinfo=tzutc())
>>> pskc.keys[2].policy.start_date
datetime.datetime(2006, 3, 1, 0, 0, tzinfo=tzutc())
>>> pskc.keys[2].policy.expiry_date
datetime.datetime(2006, 3, 31, 0, 0, tzinfo=tzutc())
>>> pskc.keys[3].policy.start_date
datetime.datetime(2006, 4, 1, 0, 0, tzinfo=tzutc())
>>> pskc.keys[3].policy.expiry_date
datetime.datetime(2006, 4, 30, 0, 0, tzinfo=tzutc())
python-pskc-0.5/tests/test_aeskw.doctest 0000644 0000000 0000000 00000017636 12767245644 020533 0 ustar root root 0000000 0000000 test_keywrap.doctest - test keywrap functions
Copyright (C) 2014-2016 Arthur de Jong
This library is free software; you can redistribute it and/or
modify it under the terms of the GNU Lesser General Public
License as published by the Free Software Foundation; either
version 2.1 of the License, or (at your option) any later version.
This library is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
Lesser General Public License for more details.
You should have received a copy of the GNU Lesser General Public
License along with this library; if not, write to the Free Software
Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
02110-1301 USA
>>> from Crypto.Util.number import long_to_bytes
>>> from binascii import a2b_hex
>>> from pskc.crypto.aeskw import wrap, unwrap
Wrap 128 bits of Key Data with a 128-bit KEK (test vector 4.1 from RFC 3394).
>>> key = a2b_hex('000102030405060708090A0B0C0D0E0F')
>>> plaintext = a2b_hex('00112233445566778899AABBCCDDEEFF')
>>> ciphertext = a2b_hex('1FA68B0A8112B447AEF34BD8FB5A7B829D3E862371D2CFE5')
>>> wrap(plaintext, key) == ciphertext
True
>>> unwrap(ciphertext, key) == plaintext
True
Wrap 128 bits of Key Data with a 192-bit KEK (test vector 4.2 from RFC 3394).
>>> key = a2b_hex('000102030405060708090A0B0C0D0E0F1011121314151617')
>>> plaintext = a2b_hex('00112233445566778899AABBCCDDEEFF')
>>> ciphertext = a2b_hex('96778B25AE6CA435F92B5B97C050AED2468AB8A17AD84E5D')
>>> wrap(plaintext, key) == ciphertext
True
>>> unwrap(ciphertext, key) == plaintext
True
Wrap 128 bits of Key Data with a 256-bit KEK (test vector 4.3 from RFC 3394).
>>> key = a2b_hex('000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F')
>>> plaintext = a2b_hex('00112233445566778899AABBCCDDEEFF')
>>> ciphertext = a2b_hex('64E8C3F9CE0F5BA263E9777905818A2A93C8191E7D6E8AE7')
>>> wrap(plaintext, key) == ciphertext
True
>>> unwrap(ciphertext, key) == plaintext
True
Wrap 192 bits of Key Data with a 192-bit KEK (test vector 4.4 from RFC 3394).
>>> key = a2b_hex('000102030405060708090A0B0C0D0E0F1011121314151617')
>>> plaintext = a2b_hex('00112233445566778899AABBCCDDEEFF0001020304050607')
>>> ciphertext = a2b_hex('031D33264E15D33268F24EC260743EDCE1C6C7DDEE725A936BA814915C6762D2')
>>> wrap(plaintext, key) == ciphertext
True
>>> unwrap(ciphertext, key) == plaintext
True
Wrap 192 bits of Key Data with a 256-bit KEK (test vector 4.5 from RFC 3394).
>>> key = a2b_hex('000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F')
>>> plaintext = a2b_hex('00112233445566778899AABBCCDDEEFF0001020304050607')
>>> ciphertext = a2b_hex('A8F9BC1612C68B3FF6E6F4FBE30E71E4769C8B80A32CB8958CD5D17D6B254DA1')
>>> wrap(plaintext, key) == ciphertext
True
>>> unwrap(ciphertext, key) == plaintext
True
Wrap 256 bits of Key Data with a 256-bit KEK (test vector 4.6 from RFC 3394).
>>> key = a2b_hex('000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F')
>>> plaintext = a2b_hex('00112233445566778899AABBCCDDEEFF000102030405060708090A0B0C0D0E0F')
>>> ciphertext = a2b_hex('28C9F404C4B810F4CBCCB35CFB87F8263F5786E2D80ED326CBC7F0E71A99F43BFB988B9B7A02DD21')
>>> wrap(plaintext, key) == ciphertext
True
>>> unwrap(ciphertext, key) == plaintext
True
Mangling the ciphertext and unwrapping results in an exception:
>>> unwrap(b'XX' + ciphertext[2:], key) # doctest: +IGNORE_EXCEPTION_DETAIL
Traceback (most recent call last):
...
DecryptionError: IV does not match
>>> unwrap(ciphertext[:-2] + b'XX', key) # doctest: +IGNORE_EXCEPTION_DETAIL
Traceback (most recent call last):
...
DecryptionError: IV does not match
>>> unwrap(ciphertext[2:], key) # doctest: +IGNORE_EXCEPTION_DETAIL
Traceback (most recent call last):
...
DecryptionError: Ciphertext length wrong
Wrap 20 octets with a 192-bit key (first example from section 6 of RFC 5649).
>>> key = a2b_hex('5840df6e29b02af1ab493b705bf16ea1ae8338f4dcc176a8')
>>> plaintext = a2b_hex('c37b7e6492584340bed12207808941155068f738')
>>> ciphertext = a2b_hex('138bdeaa9b8fa7fc61f97742e72248ee5ae6ae5360d1ae6a5f54f373fa543b6a')
>>> wrap(plaintext, key) == ciphertext
True
>>> unwrap(ciphertext, key) == plaintext
True
>>> wrap(plaintext, key, pad=False) # doctest: +IGNORE_EXCEPTION_DETAIL
Traceback (most recent call last):
...
EncryptionError: Plaintext length wrong
>>> unwrap(ciphertext, key, pad=False) # doctest: +IGNORE_EXCEPTION_DETAIL
Traceback (most recent call last):
...
DecryptionError: IV does not match
Wrap 7 octets with a 192-bit key (second example from section 6 of RFC 5649).
>>> key = a2b_hex('5840df6e29b02af1ab493b705bf16ea1ae8338f4dcc176a8')
>>> plaintext = a2b_hex('466f7250617369')
>>> ciphertext = a2b_hex('afbeb0f07dfbf5419200f2ccb50bb24f')
>>> wrap(plaintext, key) == ciphertext
True
>>> unwrap(ciphertext, key) == plaintext
True
>>> wrap(plaintext, key, pad=False) # disable padding
Traceback (most recent call last):
...
EncryptionError: Plaintext length wrong
>>> unwrap(ciphertext, key, pad=False)
Traceback (most recent call last):
...
DecryptionError: Ciphertext length wrong
Normally padding is only done if needed but it can be forced.
>>> key = a2b_hex('000102030405060708090A0B0C0D0E0F')
>>> plaintext = a2b_hex('00112233445566778899AABBCCDDEEFF')
>>> ciphertext = a2b_hex('1FA68B0A8112B447AEF34BD8FB5A7B829D3E862371D2CFE5')
>>> wrap(plaintext, key) == ciphertext
True
>>> unwrap(ciphertext, key) == plaintext
True
>>> ciphertext = a2b_hex('2cef0c9e30de26016c230cb78bc60d51b1fe083ba0c79cd5')
>>> wrap(plaintext, key, pad=True) == ciphertext
True
>>> unwrap(ciphertext, key) == plaintext
True
>>> unwrap(ciphertext, key, pad=False) # disabling padding fails IV check
Traceback (most recent call last):
...
DecryptionError: IV does not match
Padding can also be disabled. This also disables the shortcut for small
plaintexts as described in RFC 5649.
>>> key = a2b_hex('000102030405060708090A0B0C0D0E0F')
>>> plaintext = a2b_hex('0011223344556677')
>>> ciphertext = a2b_hex('f4740052e82a225174ce86fbd7b805e7')
>>> wrap(plaintext, key) == ciphertext
True
>>> unwrap(ciphertext, key) == plaintext
True
>>> wrap(plaintext, key, pad=False) # disable padding
Traceback (most recent call last):
...
EncryptionError: Plaintext length wrong
>>> unwrap(ciphertext, key, pad=False)
Traceback (most recent call last):
...
DecryptionError: Ciphertext length wrong
Lastly, an explicit IV can be set but this disables the padding functionality.
>>> key = a2b_hex('000102030405060708090A0B0C0D0E0F')
>>> plaintext = a2b_hex('0011223344556677')
>>> iv = a2b_hex('1010101010101010')
>>> wrap(plaintext, key, iv)
Traceback (most recent call last):
...
EncryptionError: Plaintext length wrong
>>> plaintext = a2b_hex('00112233445566778899AABBCCDDEEFF')
>>> ciphertext = a2b_hex('4cd926c570e19c35ace71d59a1062dae850e6a709066e0bf')
>>> wrap(plaintext, key, iv) == ciphertext
True
>>> unwrap(ciphertext, key, iv) == plaintext
True
>>> unwrap(ciphertext, key, a2b_hex('2020202020202020')) # doctest: +IGNORE_EXCEPTION_DETAIL
Traceback (most recent call last):
...
DecryptionError: IV does not match
We can fake padding by specifying an RFC 5649 IV ourselves. The length of 14
works because we have padded the plaintext with two 0 bytes.
>>> key = a2b_hex('5840df6e29b02af1ab493b705bf16ea1ae8338f4dcc176a8')
>>> plaintext = a2b_hex('c37b7e6492584340bed1220765460000')
>>> iv = a2b_hex('a65959a6') + long_to_bytes(14, 4)
>>> ciphertext = wrap(plaintext, key, iv=iv)
>>> unwrap(ciphertext, key, iv=iv) == plaintext
True
>>> unwrap(ciphertext, key) == plaintext[:14]
True
If we mangle the IV to look like an RFC 5649 value but with an invalid
padding length we should get an exception.
>>> iv = a2b_hex('a65959a6') + long_to_bytes(12, 4)
>>> ciphertext = wrap(plaintext, key, iv=iv)
>>> unwrap(ciphertext, key, iv=iv) == plaintext
True
>>> unwrap(ciphertext, key) == plaintext[:12]
Traceback (most recent call last):
...
DecryptionError: IV does not match
python-pskc-0.5/tests/draft-ietf-keyprov-pskc-02/ 0000755 0000000 0000000 00000000000 13040717606 021640 5 ustar root root 0000000 0000000 python-pskc-0.5/tests/draft-ietf-keyprov-pskc-02/figure8.pskcxml 0000644 0000000 0000000 00000004305 13036777211 024621 0 ustar root root 0000000 0000000
TokenVendorAcme0755225266Example-Issuer
MTIzNDU2Nzg5MDEyMzQ1Njc4OTA=
0
j6lwx3rvEPO0vKtMup4NbeVu8nk=
j6lwx3rvEPO0vKtMup4NbeVu8nk=
CN=Example.com,C=US
12345678
python-pskc-0.5/tests/draft-ietf-keyprov-pskc-02/figure2.pskcxml 0000644 0000000 0000000 00000001651 13036777211 024614 0 ustar root root 0000000 0000000
Manufacturer987654321IssuerMTIzNDU2Nzg5MDEyMzQ1Njc4OTA=
0
python-pskc-0.5/tests/draft-ietf-keyprov-pskc-02/figure9.pskcxml 0000644 0000000 0000000 00000007074 13036777211 024630 0 ustar root root 0000000 0000000
TokenVendorAcme654321Issuer
MTIzNDU2Nzg5MDEyMzQ1Njc4OTA=
02006-05-01T00:00:00Z2006-05-31T00:00:00ZTokenVendorAcme123456Issuer
MTIzNDU2Nzg5MDEyMzQ1Njc4OTA=
02006-05-01T00:00:00Z2006-05-31T00:00:00ZTokenVendorAcme9999999Issuer
MTIzNDU2Nzg5MDEyMzQ1Njc4OTA=
02006-03-01T00:00:00Z2006-03-31T00:00:00ZIssuer
MTIzNDU2Nzg5MDEyMzQ1Njc4OTA=
02006-04-01T00:00:00Z2006-04-30T00:00:00Z
python-pskc-0.5/tests/draft-ietf-keyprov-pskc-02/figure6.pskcxml 0000644 0000000 0000000 00000004521 13036777211 024617 0 ustar root root 0000000 0000000
MIIB5zCCAVCgAwIBAgIESZp/vDANBgkqhkiG9w0BAQUFADA4M
Q0wCwYDVQQKEwRJRVRGMRMwEQYDVQQLEwpLZXlQcm92IFdHMRIwEAYDVQQDEwlQU0tDIF
Rlc3QwHhcNMDkwMjE3MDkxMzMyWhcNMTEwMjE3MDkxMzMyWjA4MQ0wCwYDVQQKEwRJRVR
GMRMwEQYDVQQLEwpLZXlQcm92IFdHMRIwEAYDVQQDEwlQU0tDIFRlc3QwgZ8wDQYJKoZI
hvcNAQEBBQADgY0AMIGJAoGBALCWLDa2ItYJ6su80hd1gL4cggQYdyyKK17btt/aS6Q/e
DsKjsPyFIODsxeKVV/uA3wLT4jQJM5euKJXkDajzGGOy92+ypfzTX4zDJMkh61SZwlHNJ
xBKilAM5aW7C+BQ0RvCxvdYtzx2LTdB+X/KMEBA7uIYxLfXH2Mnub3WIh1AgMBAAEwDQY
JKoZIhvcNAQEFBQADgYEAe875m84sYUJ8qPeZ+NG7REgTvlHTmoCdoByU0LBBLotUKuqf
rnRuXJRMeZXaaEGmzY1kLonVjQGzjAkU4dJ+RPmiDlYuHLZS41Pg6VMwY+03lhk6I5A/w
4rnqdkmwZX/NgXg06alnc2pBsXWhL4O7nk0S2ZrLMsQZ6HcsXgdmHo=
http://www.w3.org/2000/09/xmldsig#hmac-sha1
TokenVendorAcme987654321Example-IssuerhJ+fvpoMPMO9BYpK2rdyQYGIxiATYHTHC7e/sPLKYo5/r1v+4
xTYG3gJolCWuVMydJ7Ta0GaiBPHcWa8ctCVYmHKfSz5fdeV5nqbZApe6dofTqhRwZK6
Yx4ufevi91cjN2vBpSxYafvN3c3+xIgk0EnTV4iVPRCR0rBwyfFrPc4=
0
python-pskc-0.5/tests/draft-ietf-keyprov-pskc-02/figure5.pskcxml 0000644 0000000 0000000 00000005407 13036777211 024622 0 ustar root root 0000000 0000000
Passphrase1Ej7/PEpyEpw=100016TokenVendorAcme987654321Example-Issuer
oTvo+S22nsmS2Z/RtcoF8Hfh+jzMe0RkiafpoDpnoZTjPYZu6V+A4aEn032yCr4f
cOpiQ/H7Zlj6ywiYWtwgz9cRaOA=
python-pskc-0.5/tests/draft-ietf-keyprov-pskc-02/figure3.pskcxml 0000644 0000000 0000000 00000003101 13036777211 024605 0 ustar root root 0000000 0000000
Manufacturer987654321IssuerMTIzNDU2Nzg5MDEyMzQ1Njc4OTA=
0OTPIssuerMTIzNA==
python-pskc-0.5/tests/draft-ietf-keyprov-pskc-02/figure7.pskcxml 0000644 0000000 0000000 00000002110 13036777211 024610 0 ustar root root 0000000 0000000
Manufacturer987654321IssuerkeyProfile1MasterKeyLabel0OTP
python-pskc-0.5/tests/draft-ietf-keyprov-pskc-02/figure4.pskcxml 0000644 0000000 0000000 00000003557 13036777211 024625 0 ustar root root 0000000 0000000
Pre-shared-keyhttp://www.w3.org/2000/09/xmldsig#hmac-sha1
Manufacturer987654321Issuer
pgznhXdDh4LJ2G3mOY2RL/e5cN9M3qjkBZJEE4w+NvVr64LbzkwRh9WHLAIkjXcW
zdrZbGBj9BDZJzunbfAG3kyZyYc=
0
python-pskc-0.5/tests/test_yubico.doctest 0000644 0000000 0000000 00000006570 13037001220 020651 0 ustar root root 0000000 0000000 test_yubico.doctest - tests for Yubico PSKC files
Copyright (C) 2017 Arthur de Jong
This library is free software; you can redistribute it and/or
modify it under the terms of the GNU Lesser General Public
License as published by the Free Software Foundation; either
version 2.1 of the License, or (at your option) any later version.
This library is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
Lesser General Public License for more details.
You should have received a copy of the GNU Lesser General Public
License along with this library; if not, write to the Free Software
Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
02110-1301 USA
>>> from binascii import a2b_hex, b2a_hex
>>> def tostr(x):
... return str(x.decode())
>>> def decode(f):
... return lambda x: tostr(f(x))
>>> b2a_hex = decode(b2a_hex)
>>> from pskc import PSKC
This tests the first example from draft-josefsson-keyprov-pskc-yubikey-00.
>>> pskc = PSKC('tests/yubico/example1.pskcxml')
>>> pskc.id
'yk-pskc-283599'
>>> len(pskc.keys)
1
>>> key = pskc.keys[0]
>>> key.manufacturer
'oath.UB'
>>> key.serial
'283599'
>>> key.start_date
datetime.datetime(2009, 1, 22, 0, 25, 11, tzinfo=tzutc())
>>> key.crypto_module
'1'
>>> key.id
'283599:1'
>>> key.algorithm
'http://www.yubico.com/#yubikey-aes'
>>> key.issuer
'ACME Inc.'
>>> key.response_encoding
'ALPHANUMERIC'
>>> key.response_length
44
>>> b2a_hex(key.secret)
'2b7e151628aed2a6abf7158809cf4f3c'
>>> key.key_userid
'CN=ekhgjhbctrgn, UID=ca62baca62ba'
This tests the second example from draft-josefsson-keyprov-pskc-yubikey-00.
>>> pskc = PSKC('tests/yubico/example2.pskcxml')
>>> pskc.id
'yk-pskc-283598'
>>> len(pskc.keys)
2
>>> key = pskc.keys[0] # first key
>>> key.manufacturer
'oath.UB'
>>> key.serial
'283598'
>>> key.start_date
datetime.datetime(2009, 1, 22, 0, 25, 10, tzinfo=tzutc())
>>> key.crypto_module
'1'
>>> key.id
'283598:1'
>>> key.algorithm
'http://www.yubico.com/#yubikey-aes'
>>> key.issuer
'ACME Inc.'
>>> key.response_encoding
'ALPHANUMERIC'
>>> key.response_length
44
>>> b2a_hex(key.secret)
'5698356d30868c4201e26f66c582bb45'
>>> key.key_userid
'CN=ekhgjhbctrgn, UID=ca62baca62ba'
>>> key = pskc.keys[1] # second key
>>> key.manufacturer
'oath.UB'
>>> key.serial
'283598'
>>> key.start_date
datetime.datetime(2009, 1, 22, 0, 25, 10, tzinfo=tzutc())
>>> key.crypto_module
'2'
>>> key.id
'283598:2'
>>> key.algorithm
'http://www.yubico.com/#yubikey-aes'
>>> key.issuer
'ACME Inc.'
>>> key.response_encoding
'ALPHANUMERIC'
>>> key.response_length
44
>>> b2a_hex(key.secret)
'38892b82abf1807788458fc5a5165c80'
>>> key.key_userid
'CN=ekhgjhbctrgn, UID=ca62baca62ba'
This tests the third example from draft-josefsson-keyprov-pskc-yubikey-00.
>>> pskc = PSKC('tests/yubico/example3.pskcxml')
>>> pskc.id
'yk-pskc-283597'
>>> len(pskc.keys)
1
>>> key = pskc.keys[0]
>>> key.manufacturer
'oath.UB'
>>> key.serial
'283597'
>>> key.start_date
datetime.datetime(2009, 1, 22, 0, 25, 9, tzinfo=tzutc())
>>> key.crypto_module
'1'
>>> key.id
'283597:1'
>>> key.algorithm
'http://www.yubico.com/#yubikey-aes'
>>> key.issuer
'ACME Inc.'
>>> key.response_encoding
'ALPHANUMERIC'
>>> key.response_length
40
>>> b2a_hex(key.secret)
'2b7e151628aed2a6abf7158809cf4f3c'
>>> key.key_userid
'CN=ekhgjhbctrgn, UID=ca62baca62ba'
# TODO: support extensions
python-pskc-0.5/tests/rfc6030/ 0000755 0000000 0000000 00000000000 13040717606 016024 5 ustar root root 0000000 0000000 python-pskc-0.5/tests/rfc6030/figure8.pskcxml 0000644 0000000 0000000 00000004417 13037000513 020772 0 ustar root root 0000000 0000000
MIIB5zCCAVCgAwIBAgIESZp/vDANBgkqhkiG9w0BAQUFADA4M
Q0wCwYDVQQKEwRJRVRGMRMwEQYDVQQLEwpLZXlQcm92IFdHMRIwEAYDVQQDEwlQU0tDIF
Rlc3QwHhcNMDkwMjE3MDkxMzMyWhcNMTEwMjE3MDkxMzMyWjA4MQ0wCwYDVQQKEwRJRVR
GMRMwEQYDVQQLEwpLZXlQcm92IFdHMRIwEAYDVQQDEwlQU0tDIFRlc3QwgZ8wDQYJKoZI
hvcNAQEBBQADgY0AMIGJAoGBALCWLDa2ItYJ6su80hd1gL4cggQYdyyKK17btt/aS6Q/e
DsKjsPyFIODsxeKVV/uA3wLT4jQJM5euKJXkDajzGGOy92+ypfzTX4zDJMkh61SZwlHNJ
xBKilAM5aW7C+BQ0RvCxvdYtzx2LTdB+X/KMEBA7uIYxLfXH2Mnub3WIh1AgMBAAEwDQY
JKoZIhvcNAQEFBQADgYEAe875m84sYUJ8qPeZ+NG7REgTvlHTmoCdoByU0LBBLotUKuqf
rnRuXJRMeZXaaEGmzY1kLonVjQGzjAkU4dJ+RPmiDlYuHLZS41Pg6VMwY+03lhk6I5A/w
4rnqdkmwZX/NgXg06alnc2pBsXWhL4O7nk0S2ZrLMsQZ6HcsXgdmHo=
TokenVendorAcme987654321Example-IssuerhJ+fvpoMPMO9BYpK2rdyQYGIxiATYHTHC7e/sPLKYo5/r1v+4
xTYG3gJolCWuVMydJ7Ta0GaiBPHcWa8ctCVYmHKfSz5fdeV5nqbZApe6dofTqhRwZK6
Yx4ufevi91cjN2vBpSxYafvN3c3+xIgk0EnTV4iVPRCR0rBwyfFrPc4=
0
python-pskc-0.5/tests/rfc6030/figure10.pskcxml 0000644 0000000 0000000 00000007414 12676002045 021055 0 ustar root root 0000000 0000000
TokenVendorAcme654321Issuer
MTIzNDU2Nzg5MDEyMzQ1Njc4OTA=
02006-05-01T00:00:00Z2006-05-31T00:00:00ZTokenVendorAcme123456Issuer
MTIzNDU2Nzg5MDEyMzQ1Njc4OTA=
02006-05-01T00:00:00Z2006-05-31T00:00:00ZTokenVendorAcme9999999Issuer
MTIzNDU2Nzg5MDEyMzQ1Njc4OTA=
02006-03-01T00:00:00Z2006-03-31T00:00:00ZTokenVendorAcme9999999Issuer
MTIzNDU2Nzg5MDEyMzQ1Njc4OTA=
02006-04-01T00:00:00Z2006-04-30T00:00:00Z
python-pskc-0.5/tests/rfc6030/figure2.pskcxml 0000644 0000000 0000000 00000001072 12767077756 021016 0 ustar root root 0000000 0000000
Issuer-AMTIzNA==
python-pskc-0.5/tests/rfc6030/figure9.pskcxml 0000644 0000000 0000000 00000004164 13037000513 020772 0 ustar root root 0000000 0000000
TokenVendorAcme0755225266Example-Issuer
MTIzNDU2Nzg5MDEyMzQ1Njc4OTA=
0
j6lwx3rvEPO0vKtMup4NbeVu8nk=
j6lwx3rvEPO0vKtMup4NbeVu8nk=
CN=Example.com,C=US
12345678
python-pskc-0.5/tests/rfc6030/figure6.pskcxml 0000644 0000000 0000000 00000004352 12676002045 021000 0 ustar root root 0000000 0000000
Pre-shared-key
ESIzRFVmd4iZABEiM0RVZgKn6WjLaTC1sbeBMSvIhRejN9vJa2BOlSaMrR7I5wSX
Manufacturer987654321CM_ID_001Issuer
AAECAwQFBgcICQoLDA0OD+cIHItlB3Wra1DUpxVvOx2lef1VmNPCMl8jwZqIUqGv
Su+NvtQfmvfJzF6bmQiJqoLRExc=
0
python-pskc-0.5/tests/rfc6030/figure5.pskcxml 0000644 0000000 0000000 00000003704 12676002045 020777 0 ustar root root 0000000 0000000
Manufacturer987654321CM_ID_001IssuerMTIzNDU2Nzg5MDEyMzQ1Njc4OTA=
0OTPManufacturer987654321CM_ID_001IssuerMTIzNA==
python-pskc-0.5/tests/rfc6030/figure3.pskcxml 0000644 0000000 0000000 00000002236 12676002045 020774 0 ustar root root 0000000 0000000
Manufacturer987654321DC=example-bank,DC=netCM_ID_001IssuerMTIzNDU2Nzg5MDEyMzQ1Njc4OTA=
0UID=jsmith,DC=example-bank,DC=net
python-pskc-0.5/tests/rfc6030/figure7.pskcxml 0000644 0000000 0000000 00000006104 12676002045 020776 0 ustar root root 0000000 0000000
Ej7/PEpyEpw=100016My Password 1
2GTTnLwM3I4e5IO5FkufoOEiOhNj91fhKRQBtBJYluUDsPOLTfUvoU2dStyOwYZx
TokenVendorAcme987654321CM_ID_001Example-Issuer
oTvo+S22nsmS2Z/RtcoF8Hfh+jzMe0RkiafpoDpnoZTjPYZu6V+A4aEn032yCr4f
LP6xMvjtypbfT9PdkJhBZ+D6O4w=
python-pskc-0.5/tests/rfc6030/figure4.pskcxml 0000644 0000000 0000000 00000002202 12676002045 020766 0 ustar root root 0000000 0000000
Manufacturer987654321CM_ID_001IssuerkeyProfile1MasterKeyLabel
0OTP
python-pskc-0.5/tests/test_actividentity.doctest 0000644 0000000 0000000 00000003506 13037001220 022233 0 ustar root root 0000000 0000000 test_actividentity.doctest - tests for ActivIdentity PSKC files
Copyright (C) 2017 Arthur de Jong
This library is free software; you can redistribute it and/or
modify it under the terms of the GNU Lesser General Public
License as published by the Free Software Foundation; either
version 2.1 of the License, or (at your option) any later version.
This library is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
Lesser General Public License for more details.
You should have received a copy of the GNU Lesser General Public
License along with this library; if not, write to the Free Software
Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
02110-1301 USA
>>> from binascii import a2b_hex, b2a_hex
>>> def tostr(x):
... return str(x.decode())
>>> def decode(f):
... return lambda x: tostr(f(x))
>>> b2a_hex = decode(b2a_hex)
>>> from pskc import PSKC
This tests an ActivIdentity PSKC file that was found in the wild. It does not
follow the RFC 6030 spec but is handled nonetheless.
>>> pskc = PSKC('tests/actividentity/test.pskc')
>>> pskc.encryption.algorithm
'http://www.w3.org/2001/04/xmlenc#aes128-cbc'
>>> b2a_hex(pskc.encryption.iv)
'5eeb3496c73eac92e2d2773f00d1345e'
>>> pskc.encryption.key = a2b_hex('fe0de6b806c09b762c4b49a666a27b72')
>>> pskc.mac.algorithm
'http://www.w3.org/2000/09/xmldsig#hmac-sha1'
>>> key = pskc.keys[0]
>>> key.manufacturer
'ActivIdentity'
>>> key.serial
'0950380269'
>>> key.algorithm
'http://www.ietf.org/keyprov/pskc#hotp'
>>> key.id
'0950380269'
>>> key.issuer
'ActivIdentity'
>>> key.policy.key_usage
['OTP']
>>> key.response_encoding
'DECIMAL'
>>> key.response_length
8
>>> b2a_hex(key.secret)
'dce70c2a0c1f5806f316ca8d09456eb4765ad053'
>>> key.counter
837830147
python-pskc-0.5/tests/misc/ 0000755 0000000 0000000 00000000000 13040717606 015674 5 ustar root root 0000000 0000000 python-pskc-0.5/tests/misc/integers.pskcxml 0000644 0000000 0000000 00000003314 12676002045 021116 0 ustar root root 0000000 0000000
Pre-shared-key831791NzA5NzkxAAYxSg==I9Ro0yqZSyNhPY43+fZue7JvyPxbAqtNPuFiu3HprxY=juW3FkXwJwOoyJJ24vfY+ug/J3qAnaEMrhDeJgAMWMg=
python-pskc-0.5/tests/misc/SampleFullyQualifiedNS.xml 0000644 0000000 0000000 00000011454 12767245644 022762 0 ustar root root 0000000 0000000 
C8R6xBQu36C7Z1zDXc8rN//pE3ksB2rK24916PassPhraserBdEN+D5lY5511A1isLWvCHzZAhDJ779KFlvoIv48VFT/FJjLfzOpGDSeGonSLjkCompanyXXXX0000001FToken1CompanyHMAC-SHA256PTTVlVTEiH/4HdphmBhxFJ7h5bGu5x476HXYd5jUtELg+MVqv+28/V1qT2bXdZXQ5rISLRNsZV0solNfH5WOSQ==snQNqaSQl8vxksYL9dDPrS0LHxM=0172800OTPCompanyXXXX0000001FToken2CompanyOCRA-1:HOTP-SHA256-9:QN02-T2HgO8BOgs+yOpfbrvdWV7eyi9/LdNkD/YwpXSllE+koMWkx/9n0Ms3D51Q5Av4KbRyrlGHOO61oeRYI0FYSbrdRg==L1Pne7RIEU1oLM+1kok2zfsfNSw=07200CR
python-pskc-0.5/tests/misc/odd-namespace.pskcxml 0000644 0000000 0000000 00000001101 12676002045 021766 0 ustar root root 0000000 0000000
Issuer-AMTIzNA==
python-pskc-0.5/tests/misc/policy.pskcxml 0000644 0000000 0000000 00000005156 12767245644 020622 0 ustar root root 0000000 0000000
MTIzNDU2Nzg5MDEyMzQ1Njc4OTA=2006-05-01T00:00:00Z2026-05-31T00:00:00Z4321OTPMTIzNDU2Nzg5MDEyMzQ1Njc4OTA=OTPMTIzNDU2Nzg5MDEyMzQ1Njc4OTA=OTPBarMTIzNDU2Nzg5MDEyMzQ1Njc4OTA=OTPbarMTIzNA==
python-pskc-0.5/tests/misc/checkdigits.pskcxml 0000644 0000000 0000000 00000003344 12676003033 021560 0 ustar root root 0000000 0000000
MTIzNDU2Nzg5MDEyMzQ1Njc4OTA=MTIzNDU2Nzg5MDEyMzQ1Njc4OTA=MTIzNDU2Nzg5MDEyMzQ1Njc4OTA=MTIzNDU2Nzg5MDEyMzQ1Njc4OTA=
python-pskc-0.5/tests/invalid/ 0000755 0000000 0000000 00000000000 13040717606 016367 5 ustar root root 0000000 0000000 python-pskc-0.5/tests/invalid/not-integer2.pskcxml 0000644 0000000 0000000 00000000474 12676003033 022310 0 ustar root root 0000000 0000000
python-pskc-0.5/tests/invalid/wrongversion.pskcxml 0000644 0000000 0000000 00000000762 13036777211 022544 0 ustar root root 0000000 0000000
Issuer-AMTIzNA==
python-pskc-0.5/tests/invalid/missing-encryption-method.pskcxml 0000644 0000000 0000000 00000001731 13036777211 025116 0 ustar root root 0000000 0000000
Pre-shared-keyAAECAwQFBgcICQoLDA0OD+cIHItlB3Wra1DUpxVvOx2lef1VmNPCMl8jwZqIUqGv
python-pskc-0.5/tests/invalid/mac-algorithm.pskcxml 0000644 0000000 0000000 00000003253 12676002045 022517 0 ustar root root 0000000 0000000
Pre-shared-keyESIzRFVmd4iZABEiM0RVZgKn6WjLaTC1sbeBMSvIhRejN9vJa2BOlSaMrR7I5wSXManufacturer987654321CM_ID_001IssuerAAECAwQFBgcICQoLDA0OD+cIHItlB3Wra1DUpxVvOx2lef1VmNPCMl8jwZqIUqGvSu+NvtQfmvfJzF6bmQiJqoLRExc=0
python-pskc-0.5/tests/invalid/unknown-encryption.pskcxml 0000644 0000000 0000000 00000001637 12676003033 023664 0 ustar root root 0000000 0000000
Pre-shared-key
AAECAwQFBgcICQoLDA0OD+cIHItlB3Wra1DUpxVvOx2lef1VmNPCMl8jwZqIUqGv
python-pskc-0.5/tests/invalid/wrongelement.pskcxml 0000644 0000000 0000000 00000000067 12676002045 022501 0 ustar root root 0000000 0000000
python-pskc-0.5/tests/invalid/mac-value.pskcxml 0000644 0000000 0000000 00000003274 13036777211 021655 0 ustar root root 0000000 0000000
Pre-shared-keyESIzRFVmd4iZABEiM0RVZgKn6WjLaTC1sbeBMSvIhRejN9vJa2BOlSaMrR7I5wSXManufacturer987654321CM_ID_001IssuerAAECAwQFBgcICQoLDA0OD+cIHItlB3Wra1DUpxVvOx2lef1VmNPCMl8jwZqIUqGvAu+NvtQfmvfJzF6bmQiJqoLRExc=0
python-pskc-0.5/tests/invalid/notxml.pskcxml 0000644 0000000 0000000 00000000066 12676002045 021313 0 ustar root root 0000000 0000000
python-pskc-0.5/tests/invalid/no-mac-method.pskcxml 0000644 0000000 0000000 00000001717 12767245644 022445 0 ustar root root 0000000 0000000
Pre-shared-keyAAECAwQFBgcICQoLDA0OD+cIHItlB3Wra1DUpxVvOx2lef1VmNPCMl8jwZqIUqGvLP6xMvjtypbfT9PdkJhBZ+D6O4w=
python-pskc-0.5/tests/invalid/missing-encryption.pskcxml 0000644 0000000 0000000 00000001545 13026303736 023637 0 ustar root root 0000000 0000000
Pre-shared-key
AAECAwQFBgcICQoLDA0OD+cIHItlB3Wra1DUpxVvOx2lef1VmNPCMl8jwZqIUqGv
python-pskc-0.5/tests/invalid/incomplete-derivation.pskcxml 0000644 0000000 0000000 00000003247 12767245644 024316 0 ustar root root 0000000 0000000
My Password 12GTTnLwM3I4e5IO5FkufoOEiOhNj91fhKRQBtBJYluUDsPOLTfUvoU2dStyOwYZxoTvo+S22nsmS2Z/RtcoF8Hfh+jzMe0RkiafpoDpnoZTjPYZu6V+A4aEn032yCr4fLP6xMvjtypbfT9PdkJhBZ+D6O4w=
python-pskc-0.5/tests/invalid/not-boolean.pskcxml 0000644 0000000 0000000 00000000601 12676003033 022200 0 ustar root root 0000000 0000000
python-pskc-0.5/tests/invalid/not-integer.pskcxml 0000644 0000000 0000000 00000000511 12676003033 022216 0 ustar root root 0000000 0000000
TWELVE
python-pskc-0.5/tests/test_crypto.doctest 0000644 0000000 0000000 00000005137 13036777211 020720 0 ustar root root 0000000 0000000 test_crypto.doctest - test various internal crypto helper functions
Copyright (C) 2016 Arthur de Jong
This library is free software; you can redistribute it and/or
modify it under the terms of the GNU Lesser General Public
License as published by the Free Software Foundation; either
version 2.1 of the License, or (at your option) any later version.
This library is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
Lesser General Public License for more details.
You should have received a copy of the GNU Lesser General Public
License along with this library; if not, write to the Free Software
Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
02110-1301 USA
>>> import random
>>> from binascii import a2b_hex, b2a_hex
>>> def tostr(x):
... return str(x.decode())
>>> def decode(f):
... return lambda x: tostr(f(x))
>>> b2a_hex = decode(b2a_hex)
>>> from pskc.crypto import pad, unpad
Tests for padding and unpadding. This should follow PKCS#7 as defined in RFC
5652 section 6.3.
>>> b2a_hex(pad(a2b_hex('1234'), 16))
'12340e0e0e0e0e0e0e0e0e0e0e0e0e0e'
>>> b2a_hex(pad(a2b_hex('abcdefabcdefabcdefabcdefabcdef'), 16))
'abcdefabcdefabcdefabcdefabcdef01'
>>> b2a_hex(pad(bytearray(16 * [65]), 16))
'4141414141414141414141414141414110101010101010101010101010101010'
>>> b2a_hex(unpad(a2b_hex('12340e0e0e0e0e0e0e0e0e0e0e0e0e0e'), 16))
'1234'
>>> b2a_hex(unpad(a2b_hex('abcdefabcdefabcdefabcdefabcdef01'), 16))
'abcdefabcdefabcdefabcdefabcdef'
Padding should always work but there are some conditions where unpadding does
not work. Specifically, the to be removed padding should all have the same
bytes:
>>> b2a_hex(unpad(a2b_hex('ffff0606060f0606'), 8)) # doctest: +IGNORE_EXCEPTION_DETAIL
Traceback (most recent call last):
...
DecryptionError: Invalid padding
The unpadding should also refuse to remove more than a block size worth of
data:
>>> b2a_hex(unpad(a2b_hex('ffff0e0e0e0e0e0e0e0e0e0e0e0e0e0e'), 8)) # doctest: +IGNORE_EXCEPTION_DETAIL
Traceback (most recent call last):
...
DecryptionError: Invalid padding
We generate a number of (non-cryptographically strong) random strings and
ensure that padding and unpadding works for them.
>>> for i in range(100):
... l = random.randrange(1, 255)
... r = bytearray(random.getrandbits(8) for x in range(l))
... b = random.randrange(10, 100)
... p = pad(r, b)
... u = unpad(p, b)
... if u != r:
... raise ValueError('%s -> %s -> %s (%d)' % (
... b2a_hex(r), b2a_hex(p), b2a_hex(u), b))
python-pskc-0.5/tests/test_draft_keyprov.doctest 0000644 0000000 0000000 00000007526 13037001215 022244 0 ustar root root 0000000 0000000 test_draft_keyprov.doctest - test for examples from
draft-hoyer-keyprov-pskc-algorithm-profiles-01
Copyright (C) 2014-2015 Arthur de Jong
This library is free software; you can redistribute it and/or
modify it under the terms of the GNU Lesser General Public
License as published by the Free Software Foundation; either
version 2.1 of the License, or (at your option) any later version.
This library is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
Lesser General Public License for more details.
You should have received a copy of the GNU Lesser General Public
License along with this library; if not, write to the Free Software
Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
02110-1301 USA
>>> def tostr(x):
... return str(x.decode())
>>> from pskc import PSKC
This tests an OCRA (OATH Challenge Response Algorithm) key contained within
a PSKC file as described in section 3 of
draft-hoyer-keyprov-pskc-algorithm-profiles-01.
>>> pskc = PSKC('tests/draft-hoyer-keyprov-pskc-algorithm-profiles-01/ocra.pskcxml')
>>> pskc.version
'1.0'
>>> key = pskc.keys[0]
>>> key.manufacturer
'TokenVendorAcme'
>>> key.serial
'987654322'
>>> key.id
'12345678'
>>> key.algorithm
'urn:ietf:params:xml:ns:keyprov:pskc#OCRA-1:HOTP-SHA512-8:C-QN08'
>>> key.issuer
'Issuer'
>>> key.challenge_encoding
'DECIMAL'
>>> key.challenge_min_length
8
>>> key.challenge_max_length
8
>>> key.response_encoding
'DECIMAL'
>>> key.response_length
8
>>> tostr(key.secret)
'12345678901234567890'
>>> key.counter
0
>>> key.policy.key_usage
['CR']
This tests an TOTP (OATH Time based OTP) key contained within a PSKC file as
described in section 4 of draft-hoyer-keyprov-pskc-algorithm-profiles-01.
>>> pskc = PSKC('tests/draft-hoyer-keyprov-pskc-algorithm-profiles-01/totp.pskcxml')
>>> pskc.version
'1.0'
>>> key = pskc.keys[0]
>>> key.manufacturer
'TokenVendorAcme'
>>> key.serial
'987654323'
>>> key.id
'987654323'
>>> key.algorithm
'urn:ietf:params:xml:ns:keyprov:pskc#totp'
>>> key.issuer
'Issuer'
>>> key.response_encoding
'DECIMAL'
>>> key.response_length
6
>>> tostr(key.secret)
'12345678901234567890'
>>> key.time_offset
0
>>> key.time_interval
30
>>> key.time_drift
4
>>> key.policy.key_usage
['OTP']
This tests an SecurID-AES-Counter key contained within a PSKC file as
described in section 6 of draft-hoyer-keyprov-pskc-algorithm-profiles-01.
>>> pskc = PSKC('tests/draft-hoyer-keyprov-pskc-algorithm-profiles-01/securid-aes-counter.pskcxml')
>>> pskc.version
'1.0'
>>> key = pskc.keys[0]
>>> key.manufacturer
'RSA, The Security Division of EMC'
>>> key.serial
'123456798'
>>> key.id
'23456789'
>>> key.algorithm
'http://www.rsa.com/names/2008/04/algorithms/SecurID/SecurID-AES128-Counter'
>>> key.issuer
'Issuer'
>>> key.response_encoding
'DECIMAL'
>>> key.response_length
6
>>> tostr(key.secret)
'12345678901234567890'
>>> key.counter
0
>>> key.policy.key_usage
['OTP']
>>> key.policy.start_date
datetime.datetime(2006, 4, 14, 0, 0, tzinfo=tzutc())
>>> key.policy.expiry_date
datetime.datetime(2010, 9, 30, 0, 0, tzinfo=tzutc())
This tests an ActivIdentity-3DES key contained within a PSKC file as
described in section 8 of draft-hoyer-keyprov-pskc-algorithm-profiles-01.
>>> pskc = PSKC('tests/draft-hoyer-keyprov-pskc-algorithm-profiles-01/actividentity-3des.pskcxml')
>>> pskc.version
'1.0'
>>> key = pskc.keys[0]
>>> key.manufacturer
'ActivIdentity'
>>> key.serial
'34567890'
>>> key.id
'12345677'
>>> key.algorithm
'http://www.actividentity.com/2008/04/algorithms/algorithms#ActivIdentity-3DES'
>>> key.issuer
'Issuer'
>>> key.response_encoding
'DECIMAL'
>>> key.response_length
8
>>> tostr(key.secret)
'12345678901234567890'
>>> key.counter
0
>>> key.time_offset
0
>>> key.time_interval
32
>>> key.time_drift
0
>>> key.policy.key_usage
['OTP']
python-pskc-0.5/NEWS 0000644 0000000 0000000 00000005410 13040717430 014271 0 ustar root root 0000000 0000000 changes from 0.4 to 0.5
-----------------------
* numerous compatibility improvements for reading PSKC files that do not
follow the RFC 6030 schema exactly: specifically accept a number of old
Internet Draft specifications that preceded RFC 6030 and support an
ActivIdentity file format
* split device information from key information (keep old API available) to
allow multiple keys per device (this is not allowed by RFC 6030 but was
allowed in older Internet Drafts)
* accept MAC to be over plaintext in addition to ciphertext
* fall back to using encryption key as MAC key
* refactoring of some encryption, parsing and serialising functionality into
separate modules for better maintainability
* add configuration for running test suite via Tox
* addition of a large number of test cases, bringing the branch coverage to
100%
* documentation improvements
* drop official support for Python 2.6 (the module still works but is just no
longer tested with it)
changes from 0.3 to 0.4
-----------------------
* add support for writing encrypted PSKC files (with either a pre-shared key
or PBKDF2 password-based encryption)
* extend may_use() policy checking function to check for unknown policy
elements and key expiry
* add a number of tests for existing vendor PSKC files and have full line
coverage with tests
* be more lenient in handling a number of XML files (e.g. automatically
sanitise encryption algorithm URIs, ignore XML namespaces and support more
spellings of some properties)
* support reading password or key files in pskc2csv
* support Python 3 in the pskc2csv script (thanks Mathias Laurin)
* refactoring and clean-ups to be more easily extendible (thanks Mathias
Laurin)
changes from 0.2 to 0.3
-----------------------
* support writing unencrypted PSKC files
* include a sample pskc2csv script in the source code
* fix an issue with XML namespaces for PBKDF2 parameters
* support Python 3
* update documentation
changes from 0.1 to 0.2
-----------------------
* raise exceptions on parsing, decryption and other problems
* support Python 2.6 and multiple ElementTree implementations (lxml is
required when using Python 2.6)
* support more encryption algorithms (AES128-CBC, AES192-CBC, AES256-CBC,
TripleDES-CBC, KW-AES128, KW-AES192, KW-AES256 and KW-TripleDES) and be
more lenient in accepting algorithm URIs
* support all HMAC algorithms that Python's hashlib module has hash functions
for (HMAC-MD5, HMAC-SHA1, HMAC-SHA224, HMAC-SHA256, HMAC-SHA384 and
HMAC-SHA512)
* support PRF attribute of PBKDF2 algorithm
* support creating PSKC objects and keys
* when accessing values for which a MAC is present, a MAC failure will raise
an exception (DecryptionError)
* many code cleanups
* improve test coverage
changes in 0.1
--------------
Initial release
python-pskc-0.5/ChangeLog 0000644 0000000 0000000 00000135745 13040703436 015364 0 ustar root root 0000000 0000000 2017-01-15 Arthur de Jong
* [29a183d] tests/test_feitian.doctest, tests/test_nagraid.doctest:
Split vendor tests
Have one doctest file per vendor to make tests a little more
manageable.
2017-01-14 Arthur de Jong
* [02eb520] tests/test_yubico.doctest, tests/yubico/example1.pskcxml,
tests/yubico/example2.pskcxml, tests/yubico/example3.pskcxml:
Add tests for Yubikey files
This adds tests from draft-josefsson-keyprov-pskc-yubikey-00.
2017-01-13 Arthur de Jong
* [12dfa64] pskc/parser.py, tests/actividentity/test.pskc,
tests/test_actividentity.doctest: Support legacy ActivIdentity
files
This adds support for parsing ActivIdentity files that conform
to a very old version of an Internet Draft. The implementation
and test were based on a file provided by Jaap Ruijgrok.
2017-01-11 Arthur de Jong
* [a5e2343] pskc/parser.py,
tests/draft-hoyer-keyprov-pskc-algorithm-profiles-01/actividentity-3des.pskcxml,
tests/draft-hoyer-keyprov-pskc-algorithm-profiles-01/ocra.pskcxml,
tests/draft-hoyer-keyprov-pskc-algorithm-profiles-01/securid-aes-counter.pskcxml,
tests/draft-hoyer-keyprov-pskc-algorithm-profiles-01/totp.pskcxml:
Use original examples from old profiles Internet Draft
This updates the tests to use the original examples from
draft-hoyer-keyprov-pskc-algorithm-profiles-01 instead of
modifying them to fit the RFC 6030 schema (but does include some
minor changes to make them valid XML).
This adds a few additions to the parser to handle legacy challenge
and resposne encoding and a few key policy properties.
This also includes a fix for 0b757ec in the handling of the
element under a element.
2016-12-21 Arthur de Jong
* [2f7cb1a] tests/rfc6030/figure8.pskcxml,
tests/rfc6030/figure9.pskcxml, tests/test_rfc6030.doctest:
Add all figures from RFC 6030 to test suite
Note that asymmetric encryption and digital signature checking
has not yet been implemented so the tests are pretty minimal.
2016-12-21 Arthur de Jong
* [0b757ec] pskc/parser.py, pskc/xml.py,
tests/draft-ietf-keyprov-pskc-02/figure2.pskcxml,
tests/draft-ietf-keyprov-pskc-02/figure3.pskcxml,
tests/draft-ietf-keyprov-pskc-02/figure4.pskcxml,
tests/draft-ietf-keyprov-pskc-02/figure5.pskcxml,
tests/draft-ietf-keyprov-pskc-02/figure6.pskcxml,
tests/draft-ietf-keyprov-pskc-02/figure7.pskcxml,
tests/draft-ietf-keyprov-pskc-02/figure8.pskcxml,
tests/draft-ietf-keyprov-pskc-02/figure9.pskcxml,
tests/test_draft_ietf_keyprov_pskc_02.doctest: Add support for
older Internet Draft version
This adds support for parsing most examples from
draft-ietf-keyprov-pskc-02. That file uses a few other names
for elements and attributes of the PSKC file and a few other
minor differences.
The XML parsing has been changed to allow specifying multiple
matches and the find*() functions now return the first found match.
While all examples from draft-ietf-keyprov-pskc-02 are tested
support for verifying digital signatures and asymmetric keys
have not yet been implemented.
2016-12-19 Arthur de Jong
* [09076f8] tests/test_encryption.doctest: Fix typo in test
2016-12-20 Arthur de Jong
* [46fa5f1] setup.cfg: Fail tests on missing coverage
2016-12-20 Arthur de Jong
* [047a2a9] pskc/key.py, pskc/mac.py,
tests/encryption/mac-over-plaintext.pskcxml,
tests/invalid/mac-missing.pskcxml, tests/invalid/mac-value.pskcxml,
tests/invalid/missing-encryption-method.pskcxml,
tests/test_encryption.doctest, tests/test_invalid.doctest:
Allow MAC over plaintext or ciphertext
RFC 6030 implies that the MAC should be performed over the
ciphertext but some earlier drafts implied that the MAC should
be performed on the plaintext. This change accpets the MAC if
either the plaintext or ciphertext match.
Note that this change allows for a padding oracle attack when
CBC encryption modes are used because decryption (and unpadding)
needs to be done before MAC checking. However, this module is
not expected to be available to users to process arbitrary PSKC
files repeatedly.
This removes the tests for a missing MAC key (and replaces it for
tests of missing EncryptionMethod) because falling back to using
the encryption key (implemented in a444f78) in combination with
this change means that decryption is performed before MAC checking
and is no longer possible to trigger a missing MAC key error.
2016-12-19 Arthur de Jong
* [bae7084] pskc/crypto/__init__.py, pskc/encryption.py,
tests/test_crypto.doctest: Add sanity checks to unpadding
2016-12-19 Arthur de Jong
* [d864bc8] pskc/serialiser.py: Ensure XML file ends with a newline
2016-12-19 Arthur de Jong
* [c631628] pskc/xml.py: Adapt coverage pragma annotations
This fixes the pragma directives to be be correct independently
of whether lxml is installed or not.
2016-12-19 Arthur de Jong
* [18d82dc] .gitignore, tox.ini: Add Tox configuration
This sets up Tox with various versions of Python and for each
version a run with and without lxml.
2016-12-19 Arthur de Jong
* [71058e2] tests/test_write.doctest: Close read files in tests
This ensures that the files that are read in the test suite are
properly closed to avoid leaking open file descriptors.
2016-12-18 Arthur de Jong
* [f0a0a3b] pskc/parser.py: Support missing or lowercase version
attribute
2016-09-26 Arthur de Jong
* [3bf4737] docs/usage.rst: Fix copy-pasto in documentation
This accidentally slipped in as part of beafc6b. 2016-09-19
Arthur de Jong
* [02b30a9] pskc/__init__.py, pskc/parser.py, pskc/serialiser.py:
Also move outer writing and parsing to modules
2016-09-17 Arthur de Jong
* [b1f8f87] .gitignore, README, pskc/__init__.py: Add writing
example to toplevel documentation
2016-09-17 Arthur de Jong
* [e23a467] pskc/key.py: Use custom data descriptors for key
properties
This uses a custom data descriptor (property) for secret, counter,
time_offset, time_interval and time_drift.
2016-09-17 Arthur de Jong
* [beafc6b] docs/usage.rst, pskc/__init__.py, pskc/device.py,
pskc/key.py, pskc/parser.py, pskc/policy.py, pskc/serialiser.py,
tests/test_misc.doctest, tests/test_write.doctest: Support
separate device from key
This allows having multiple keys per device while also maintaining
the previous API.
Note that having multiple keys per device is not allowed by the
RFC 6030 schema but is allowed by some older internet drafts.
2016-09-16 Arthur de Jong
* [84bfb8a] pskc/__init__.py, pskc/encryption.py, pskc/key.py,
pskc/mac.py, pskc/policy.py, pskc/serialiser.py: Move XML
generation to own module
Similar to the change for parsing, move the XML serialisation
of PSKC data to a single class in a separate module.
2016-09-14 Arthur de Jong
* [426e821] pskc/__init__.py, pskc/encryption.py, pskc/key.py,
pskc/mac.py, pskc/parser.py, pskc/policy.py: Move document
parsing to own module
This moves all the parse() functions to a single class in a
dedicated module that can be used for parsing PSKC files. This
should make it easier to subclass the parser.
2016-09-14 Arthur de Jong
* [bf34209] tests/invalid/no-mac-method.pskcxml,
tests/test_invalid.doctest, tests/test_rfc6030.doctest: Some
minor improvements to the tests
2016-09-12 Arthur de Jong
* [600ae68] pskc/encryption.py, pskc/key.py, pskc/xml.py,
setup.cfg, tests/invalid/empty-mac-key.pskcxml,
tests/invalid/incomplete-derivation.pskcxml,
tests/invalid/missing-encryption.pskcxml,
tests/misc/SampleFullyQualifiedNS.xml, tests/misc/policy.pskcxml,
tests/test_aeskw.doctest, tests/test_encryption.doctest,
tests/test_invalid.doctest, tests/test_misc.doctest,
tests/test_write.doctest: Improve branch coverage
This enables branch coverage testing and adds tests to improve
coverage.
2016-09-11 Arthur de Jong
* [713d106] pskc/encryption.py, tests/test_encryption.doctest:
Support specifying PRF in setup_pbkdf2()
This also ensures that the PRF URL is normalised.
2016-09-11 Arthur de Jong
* [ff811c9] pskc/encryption.py: Fix bug in passing explicit key
to setup_preshared_key()
2016-09-11 Arthur de Jong
* [fa07aa5] docs/encryption.rst, pskc/encryption.py: Clarify
encryption.setup_*() documentation
This tries to make it clearer that the setup_preshared_key()
and setup_pbkdf2() functions are meant to be used when writing
out PSKC files.
2016-04-23 Arthur de Jong
* [a444f78] pskc/key.py, pskc/mac.py,
tests/encryption/no-mac-key.pskcxml,
tests/invalid/mac-missing.pskcxml, tests/test_encryption.doctest,
tests/test_invalid.doctest: Fall back to encryption key for MAC
This uses the encryption key also as MAC key if no MAC key has
been specified in the PSKC file. Earlier versions of the PSKC
draft specified this behaviour.
2016-04-23 Arthur de Jong
* [9b76135] pskc/encryption.py,
tests/encryption/aes128-cbc-noiv.pskcxml,
tests/test_encryption.doctest: Allow global specification of IV
In older versions of the PSKC standard it was allowed to
have a global initialization vector for CBC based encryption
algorithms. It is probably not a good idea to re-use an IV
in general.
2016-04-23 Arthur de Jong
* [d53f05b] pskc/encryption.py, pskc/mac.py: Move crypto to functions
This makes it much easier to test the encryption, decryption
and HMAC processing separate from the PSKC parsing.
2016-04-05 Arthur de Jong
* [5dbfefd] pskc/__init__.py, pskc/encryption.py, pskc/key.py,
pskc/policy.py: Remove parse call from constructors
This makes the creation if internal instances a litte more
consistent.
2016-04-05 Arthur de Jong
* [0d7caf1] pskc/algorithms.py, pskc/encryption.py, pskc/mac.py:
Move algorithm uri handling to separate module
2016-03-29 Arthur de Jong
* [22ba9f1] pskc/crypto/__init__.py, pskc/encryption.py: Move
padding functions to crypto package
2016-03-28 Arthur de Jong
* [efbe94c] ChangeLog, NEWS, pskc/__init__.py, setup.py: Get files
ready for 0.4 release
2016-03-26 Arthur de Jong
* [0c57335] docs/policy.rst: Document may_use() policy function
2016-03-27 Arthur de Jong
* [b4a6c72] : Implement writing encrypted files
This adds support for setting up encryption keys and password-based
key derivation when writing PSKC files. Also MAC keys are set
up when needed.
2016-03-26 Arthur de Jong
* [59aa65b] README, docs/conf.py, docs/encryption.rst, docs/mac.rst,
docs/usage.rst, pskc/__init__.py: Document writing encrypted files
2016-03-21 Arthur de Jong
* [5f32528] tests/test_write.doctest: Add encryption error tests
2016-03-21 Arthur de Jong
* [7ede4a1] tests/test_write.doctest: Add tests for writing
encrypted PSKC files
2016-03-20 Arthur de Jong
* [1ff3237] pskc/encryption.py: Allow configuring a pre-shared key
This method allows configuring a pre-shared encryption key and
will chose reasonable defaults for needed encryption values
(e.g. it will choose an algorithm, generate a new key of the
appropriate length if needed, etc.).
2016-03-19 Arthur de Jong
* [50414a3] pskc/encryption.py, tests/test_encryption.doctest:
Allow configuring PBKDF2 key derivation
This factors out the PBKDF2 key derivation to a separate function
and introduces a function to configure KeyDerivation instances
with PBKDF2.
2016-03-21 Arthur de Jong
* [5ac9d43] pskc/mac.py, tests/test_encryption.doctest: Allow
configuring a MAC key
This method will set up a MAC key and algorithm as specified or
use reasonable defauts.
2016-03-20 Arthur de Jong
* [16da531] pskc/key.py, pskc/mac.py: Generate MAC values
2016-03-20 Arthur de Jong
* [ca0fa36] pskc/__init__.py, pskc/encryption.py, pskc/mac.py:
Write MACMethod
This also makes the MAC.algorithm a property similarly as what
is done for Encryption (normalise algorithm names) and adds a
setter for the MAC.key property.
2016-03-21 Arthur de Jong
* [8fd35ba] pskc/encryption.py, pskc/key.py: Write out encrypted
values
The Encryption class now has a fields property that lists the
fields that should be encrypted when writing the PSKC file.
This adds an encrypt_value() function that performs the encryption
and various functions to convert the plain value to binary before
writing the encrypted XML elements.
2016-03-20 Arthur de Jong
* [eba541e] pskc/__init__.py, pskc/encryption.py, pskc/mac.py:
Make Encryption and MAC constructors consistent
This removes calling parse() from the Encryption and MAC
constructors and stores a reference to the PSKC object in both
objects so it can be used later on.
2016-03-20 Arthur de Jong
* [fe21231] pskc/__init__.py, pskc/encryption.py,
tests/test_write.doctest: Write encryption key information
This writes information about a pre-shared key or PBKDF2 key
derivation in the PSKC file. This also means that writing
a decrypted version of a previously encrypted file requires
actively removing the encryption.
2016-03-19 Arthur de Jong
* [0893640] pskc/encryption.py, tests/test_misc.doctest: Add
algorithm_key_lengths property
This property on the Encryption object provides a list of key
sizes (in bytes) that the configured encryption algorithm supports.
2016-03-22 Arthur de Jong
* [8b5f6c2] pskc/policy.py, tests/test_misc.doctest,
tests/test_rfc6030.doctest, tests/test_write.doctest: Also check
key expiry in may_use()
2016-03-20 Arthur de Jong
* [dfa57ae] pskc2csv.py: Support reading password or key in pskc2csv
This supports reading the encryption password or key from the
command line or from a file.
2014-06-28 Arthur de Jong
* [0744222] pskc/xml.py: Copy namespaces to toplevel element
Ensure that when writing an XML file all namespace definitions
are on the toplevel KeyContainer element instead of scattered
throughout the XML document.
2016-03-19 Arthur de Jong
* [e8ef157] pskc/__init__.py, tests/test_write.doctest: Support
writing to text streams in Python 3
This supports writing the XML output to binary streams as well
as text streams in Python 3.
2016-03-19 Arthur de Jong
* [cadc6d9] pskc/key.py, pskc/mac.py,
tests/invalid/missing-encryption.pskcxml,
tests/invalid/not-boolean.pskcxml,
tests/invalid/not-integer.pskcxml,
tests/invalid/not-integer2.pskcxml,
tests/invalid/unknown-encryption.pskcxml, tests/test_aeskw.doctest,
tests/test_encryption.doctest, tests/test_invalid.doctest,
tests/test_misc.doctest, tests/test_rfc6030.doctest,
tests/test_tripledeskw.doctest, tests/test_write.doctest:
Improve tests and test coverage
This adds tests to ensure that incorrect attribute and value
types in the PSKC file raise a ValueError exception and extends
the tests for invalid encryption options.
This removes some code or adds no cover directives to a few
places that have unreachable code or are Python version specific
and places doctest directives inside the doctests where needed.
2016-03-19 Arthur de Jong
* [b8905e0] pskc/key.py, pskc/xml.py, tests/misc/checkdigits.pskcxml,
tests/test_misc.doctest: Support both CheckDigit and CheckDigits
RFC 6030 is not clear about whether the attribute of
ChallengeFormat and ResponseFormat should be the singular
CheckDigit or the plural CheckDigits. This ensures that both
forms are accepted.
2016-03-19 Arthur de Jong
* [7915c55] pskc/policy.py, tests/misc/policy.pskcxml,
tests/test_misc.doctest: Implement policy checking
This checks for unknown policy elements in the PSKC file and
will cause the key usage policy check to fail.
2016-03-18 Arthur de Jong
* [1687fd6] tests/feitian/20120919-test001-4282.xml,
tests/feitian/file1.pskcxml, tests/nagraid/file1.pskcxml,
tests/test_vendors.doctest: Add a few tests for vendor files
Some vendor-specific files were lifted from the LinOTP test suite
and another Feitian file was found in the oath-toolkit repository.
2016-01-31 Arthur de Jong
* [aae8a18] pskc/key.py, tests/misc/integers.pskcxml,
tests/test_misc.doctest: Support various integer representations
This extends support for handling various encoding methods for
integer values in PSKC files. For encrypted files the decrypted
value is first tried to be evaluated as an ASCII representation
of the number and after that big-endian decoded.
For plaintext values first ASCII decoding is tried after which
base64 decoding is tried which tries the same encodings as for
decrypted values.
There should be no possibility for any base64 encoded value
(either of an ASCII value or a big-endian value) to be interpreted
as an ASCII value for any 32-bit integer.
There is a possibility that a big-endian encoded integer could
be incorrectly interpreted as an ASCII value but this is only
the case for 110 numbers when only considering 6-digit numbers.
2016-01-24 Arthur de Jong
* [c86aaea] README, pskc/__init__.py,
tests/draft-hoyer-keyprov-pskc-algorithm-profiles-01/actividentity-3des.pskcxml,
tests/draft-hoyer-keyprov-pskc-algorithm-profiles-01/ocra.pskcxml,
tests/draft-hoyer-keyprov-pskc-algorithm-profiles-01/securid-aes-counter.pskcxml,
tests/draft-hoyer-keyprov-pskc-algorithm-profiles-01/totp.pskcxml,
tests/encryption/aes128-cbc.pskcxml,
tests/encryption/aes192-cbc.pskcxml,
tests/encryption/aes256-cbc.pskcxml,
tests/encryption/kw-aes128.pskcxml,
tests/encryption/kw-aes192.pskcxml,
tests/encryption/kw-aes256.pskcxml,
tests/encryption/kw-tripledes.pskcxml,
tests/encryption/tripledes-cbc.pskcxml,
tests/invalid/encryption.pskcxml,
tests/invalid/mac-algorithm.pskcxml,
tests/invalid/mac-value.pskcxml,
tests/invalid/no-mac-method.pskcxml, tests/invalid/notxml.pskcxml,
tests/invalid/wrongelement.pskcxml,
tests/invalid/wrongversion.pskcxml,
tests/misc/SampleFullyQualifiedNS.xml,
tests/misc/odd-namespace.pskcxml, tests/rfc6030/figure10.pskcxml,
tests/rfc6030/figure2.pskcxml, tests/rfc6030/figure3.pskcxml,
tests/rfc6030/figure4.pskcxml, tests/rfc6030/figure5.pskcxml,
tests/rfc6030/figure6.pskcxml, tests/rfc6030/figure7.pskcxml,
tests/test_draft_keyprov.doctest, tests/test_encryption.doctest,
tests/test_invalid.doctest, tests/test_misc.doctest,
tests/test_rfc6030.doctest, tests/test_write.doctest: Re-organise
test files
This puts the test PSKC files in subdirectories so they can be
organised more cleanly.
2016-01-23 Arthur de Jong
* [1904dc2] tests/test_misc.doctest: Add test for incorrect key
derivation
If no key derivation algorithm has been specified in the PSKC
file an exception should be raised when attempting to perform
key derivation.
2016-01-24 Arthur de Jong
* [91f66f4] pskc/encryption.py, pskc/key.py, pskc/mac.py: Refactor
out EncryptedValue and ValueMAC
This removes the EncryptedValue and ValueMAC classes and instead
moves the XML parsing of these values to the DataType class. This
will make it easier to support different parsing schemes.
This also includes a small consistency improvement in the
subclasses of DataType.
2016-01-23 Arthur de Jong
* [9b13d3b] pskc/encryption.py, tests/test_misc.doctest: Normalise
algorithm names
This transforms the algorithm URIs that are set to known values
when parsing or setting the algorithm.
2016-01-22 Arthur de Jong
* [b6eab47] docs/encryption.rst, pskc/encryption.py,
tests/test_encryption.doctest, tests/test_misc.doctest: Add
encryption algorithm property
Either determine the encryption algorithm from the PSKC file
or from the explicitly set value. This also adds support for
setting the encryption key name.
2016-01-22 Arthur de Jong
* [b5f7de5] pskc/key.py, tests/test_write.doctest: Fix a problem
when writing previously encrypted file
This fixes a problem with writing a PSKC file that is based on
a read file that was encrypted.
2016-01-22 Arthur de Jong
* [107a836] pskc/__init__.py, pskc/encryption.py, pskc/key.py,
pskc/mac.py, pskc/policy.py, pskc/xml.py: Strip XML namespaces
before parsing
This simplifies calls to the find() family of functions and
allows parsing PSKC files that have slightly different namespace
URLs. This is especially common when parsing old draft versions
of the specification.
This also removes passing multiple patterns to the find()
functions that was introduced in 68b20e2.
2015-12-28 Arthur de Jong
* [a86ff8a] README, docs/encryption.rst: Update some documentation
This adds a development notes section to the README and changes
the wording on the encryption page.
2015-12-01 Mathias Laurin
* [0ff4154] docs/encryption.rst: Fix typo in the documentation
2015-12-01 Mathias Laurin
* [3473903] pskc2csv.py: Support Python 3
2015-11-30 Mathias Laurin
* [a82a60b] pskc/key.py: Make value conversion methods static private
- the conversions do not call self: they are static - the
conversions are not to be used out of the class: make private
2015-11-30 Mathias Laurin
* [e711a30] pskc/key.py: Provide abstract methods to clarify API
2015-11-30 Mathias Laurin
* [1577687] pskc/encryption.py: Fix typo in variable name
2015-11-30 Mathias Laurin
* [3aa2a6f] tests/test_invalid.doctest: Fix doctest:
IGNORE_EXCEPTION_DETAL
2015-10-07 Arthur de Jong
* [c155d15] ChangeLog, MANIFEST.in, NEWS, pskc/__init__.py,
setup.py: Get files ready for 0.3 release
2015-10-07 Arthur de Jong
* [cf0c9e6] README, docs/conf.py, docs/encryption.rst,
docs/exceptions.rst, docs/mac.rst, docs/policy.rst, docs/usage.rst,
pskc/__init__.py: Update documentation
This updates the documentation with the new features (writing PSKC
files) as well as many editorial improvements, some rewording
and a few typo fixes. Some things were moved around a little in
order to be more easily readable and easier to find.
2015-10-06 Arthur de Jong
* [671b6e2] pskc/__init__.py, pskc/crypto/aeskw.py,
pskc/crypto/tripledeskw.py, pskc/encryption.py, pskc/key.py,
pskc/policy.py, pskc/xml.py, setup.py, tests/test_aeskw.doctest,
tests/test_draft_keyprov.doctest, tests/test_encryption.doctest,
tests/test_invalid.doctest, tests/test_misc.doctest,
tests/test_rfc6030.doctest, tests/test_tripledeskw.doctest,
tests/test_write.doctest: Support Python 3
This enables support for Python 3 together with Python 2 support
with a single codebase.
On Python 3 key data is passed around as bytestrings which makes
the doctests a little harder to maintain across Python versions.
2015-10-06 Arthur de Jong
* [68b20e2] pskc/encryption.py, pskc/xml.py,
tests/SampleFullyQualifiedNS.xml, tests/test_misc.doctest:
Fix issue with namespaced PBKDF2 parameters
The find() utility functions now allow specifying multiple paths
to be searched where the first match is returned.
This allows handling PSKC files where the PBKDF2 salt, iteration
count, key length and PRF elements are prefixed with the xenc11
namespace.
A test including such a PSKC file has been included.
Thanks to Eric Plet for reporting this.
2014-10-12 Arthur de Jong
* [ebe46f2] pskc2csv.py: Provide a sample pskc2csv script
This is a simple command-line utility that reads a PSKC file
and outputs information on keys as CSV.
2014-06-30 Arthur de Jong
* [1363564] pskc/crypto/__init__.py, pskc/crypto/aeskw.py,
pskc/crypto/tripledeskw.py, pskc/encryption.py,
tests/test_aeskw.doctest, tests/test_tripledeskw.doctest: Move
encryption functions in pskc.crypto package
This moves the encryption functions under the pskc.crypto package
to more clearly separate it from the other code. Ideally this
should be replaced by third-party library code.
2014-06-30 Arthur de Jong
* [e468ebe] pskc/__init__.py, pskc/encryption.py, pskc/key.py,
pskc/mac.py, pskc/policy.py, pskc/xml.py: Rename pskc.parse
to pskc.xml
This renames the parse module to xml to better reflect the
purpose of the module and it's functions.
This also introduces a parse() function that wraps etree.parse().
2014-06-28 Arthur de Jong
* [480e2d0] : Support writing unencrypted PSKC files
2014-06-27 Arthur de Jong
* [37dc64a] tests/test_write.doctest: Add test for writing PSKC files
This makes a simple doctest that checks the writing of the XML
representation of the PSKC data.
2014-06-27 Arthur de Jong
* [865a755] pskc/__init__.py, pskc/parse.py: Add function for
writing XML
This provides a function for pretty-printing the generated
XML document.
2014-06-27 Arthur de Jong
* [61a192f] pskc/__init__.py, pskc/key.py, pskc/policy.py: Construct
XML document with basic PKSC information
This introduces make_xml() functions to build an XML document
that contains the basic PSKC information and keys. This currently
only supports writing unencrypted PSKC files.
2014-06-27 Arthur de Jong
* [69aec9f] pskc/parse.py: Introduce mk_elem() to create elements
This introduces the mk_elem() function that can be used to create
ElementTree elements for building XML documents. This function
transparetly handles namespaces, translation of values into
XML etc.
2014-06-27 Arthur de Jong
* [7591271] pskc/key.py: Simplify DataType value handling
Only store the native value of the property, not the text
representation. This also results in the BinaryDataType and
IntegerDataType subclasses only needing from_text() and from_bin()
functions.
2014-06-19 Arthur de Jong
* [09eb6b3] ChangeLog, NEWS, docs/changes.rst, docs/index.rst,
docs/usage.rst, pskc/__init__.py, setup.py: Get files ready for
0.2 release
2014-06-19 Arthur de Jong
* [62c9af4] pskc/__init__.py: Only catch normal exceptions
2014-06-18 Arthur de Jong
* [deb57d7] pskc/__init__.py: Remove unused import
2014-06-17 Arthur de Jong
* [178ef1c] pskc/encryption.py: PEP8 fix
2014-06-17 Arthur de Jong
* [7435552] pskc/exceptions.py: Remove __str__ from exception
The message property has been deprecated as of Python 2.6 and
printing the first argument is the default.
2014-06-16 Arthur de Jong
* [f084735] README, docs/encryption.rst, docs/exceptions.rst,
docs/index.rst, docs/mac.rst, docs/policy.rst, docs/usage.rst:
Update documentation
This updates the documentation with the current API, adding
information on exceptions raised, HMAC algorithms supported and
changes to the MAC checking.
This also includes some editorial changes to some of the text and
making references shorter by not including the full package path.
2014-06-15 Arthur de Jong
* [d84e761] pskc/parse.py: Simplify finding ElementTree
implementation
These are the only ElementTree implementations that have been
tested to provide the needed functionality (mostly namespaces).
2014-06-15 Arthur de Jong
* [50b429d] pskc/key.py, pskc/parse.py, pskc/policy.py: Refactor
out some functions to parse
This introduces the getint() and getbool() functions in parse
to avoid some code duplication.
2014-06-15 Arthur de Jong
* [9a16ce4] pskc/key.py, tests/test_misc.doctest: Add support for
setting secret
This supports setters for the secret, counter, time_offset,
time_interval and time_drift properties. Setting these values
stores the values unencrypted internally.
2014-06-14 Arthur de Jong
* [1b9ee9f] pskc/encryption.py: Support PBKDF2 PRF argument
Support specifying a pseudorandom function for PBKDF2 key
derivation. It currently supports any HMAC that the MAC checking
also supports.
2014-06-14 Arthur de Jong
* [79b9a7d] pskc/mac.py: Provide a get_hmac() function
Refactor the functionality to find an HMAC function into a
separate function.
2014-06-14 Arthur de Jong
* [1417d4a] tests/invalid-mac-algorithm.pskcxml,
tests/invalid-mac-value.pskcxml,
tests/invalid-no-mac-method.pskcxml, tests/test_invalid.doctest:
Add tests for missing or invalid MAC
This tests for incomplete, unknown or invalid MACs in PSKC files.
2014-06-14 Arthur de Jong
* [9d8aae0] pskc/key.py, pskc/mac.py: Raise exception when MAC
validation fails
This changes the way the check() function works to raise an
exception when the MAC is not correct. The MAC is also now always
checked before attempting decryption.
This also renames the internal DataType.value property to a
get_value() method for clarity.
2014-06-14 Arthur de Jong
* [699ecf8] pskc/encryption.py: Handle missing MAC algorithm properly
2014-06-14 Arthur de Jong
* [01e102b] tests/aes128-cbc.pskcxml, tests/aes192-cbc.pskcxml,
tests/aes256-cbc.pskcxml, tests/test_encryption.doctest,
tests/tripledes-cbc.pskcxml: Add MAC tests to all CBC encrypted
keys
This adds hmac-sha224, hmac-sha256, hmac-sha384 and hmac-sha512
tests for values that are encrypted using CBC block cypher modes.
2014-06-14 Arthur de Jong
* [59e790e] pskc/mac.py: Automatically support all MACs in hashlib
This uses the name of the hash to automatically get the correct
hash object from Python's hashlib.
2014-06-14 Arthur de Jong
* [566e447] pskc/__init__.py, pskc/parse.py, setup.py: Support
various ElementTree implementations
When using a recent enough lxml, even Python 2.6 should work
now. The most important requirement is that the findall()
function supports the namespaces argument.
This also now catches all exceptions when parsing the PSKC file
fails and wraps it in ParseError because various implementations
raise different exceptions, even between versions (Python 2.6's
ElementTree raises ExpatError, lxml raises XMLSyntaxError).
2014-06-13 Arthur de Jong
* [5d60ee2] pskc/__init__.py, pskc/encryption.py, pskc/key.py,
pskc/mac.py, pskc/parse.py, pskc/policy.py: Have parse module
provide find() functions
This changes the parse module functions to better match the
ElementTree API and extends it with findint(), findtime()
and findbin().
It also passes the namespaces to all calls that require it
without duplicating this throughout the normal code.
2014-06-11 Arthur de Jong
* [6a34c01] pskc/__init__.py, pskc/encryption.py, pskc/key.py,
pskc/mac.py, pskc/policy.py: Use get() instead of attrib.get()
(shorter)
2014-05-31 Arthur de Jong
* [4d92b93] pskc/encryption.py, tests/kw-tripledes.pskcxml,
tests/test_encryption.doctest: Support kw-tripledes decryption
This adds support for key unwrapping using the RFC 3217 Triple
DES key wrap algorithm if the PSKC file uses this.
2014-05-31 Arthur de Jong
* [fd71f01] pskc/tripledeskw.py, tests/test_tripledeskw.doctest:
Implement RFC 3217 Triple DES key wrapping
2014-05-31 Arthur de Jong
* [f639318] tests/test_minimal.doctest, tests/test_misc.doctest:
Merge test_minimal into test_misc
2014-05-31 Arthur de Jong
* [1e7f861] tests/draft-keyprov-actividentity-3des.pskcxml,
tests/test_draft_keyprov.doctest: Add an ActivIdentity-3DES test
The test is taken from
draft-hoyer-keyprov-pskc-algorithm-profiles-01 modified to fit
the schema as described in RFC 6030.
2014-05-31 Arthur de Jong
* [b7cb928] tests/draft-keyprov-securid-aes-counter.pskcxml,
tests/test_draft_keyprov.doctest: Add an SecurID-AES-Counter test
The test is taken from
draft-hoyer-keyprov-pskc-algorithm-profiles-01 modified to be
valid XML and to fit the schema as described in RFC 6030.
2014-05-31 Arthur de Jong
* [427319f] tests/draft-keyprov-totp.pskcxml,
tests/test_draft_keyprov.doctest: Add an TOTP test
The test is taken from
draft-hoyer-keyprov-pskc-algorithm-profiles-01 modified to fit
the schema as described in RFC 6030.
2014-05-31 Arthur de Jong
* [ba49d09] tests/draft-keyprov-ocra.pskcxml,
tests/test_draft_keyprov.doctest: Add an OCRA test
The test is taken from
draft-hoyer-keyprov-pskc-algorithm-profiles-01 modified to fit
the schema as described in RFC 6030.
2014-05-31 Arthur de Jong
* [0a66ede] tests/odd-namespace.pskcxml, tests/test_misc.doctest:
Add a test for an odd namespace
2014-05-30 Arthur de Jong
* [287afa7] pskc/encryption.py, tests/kw-aes128.pskcxml,
tests/kw-aes192.pskcxml, tests/kw-aes256.pskcxml,
tests/test_encryption.doctest: Support kw-aes128, kw-aes192
and kw-aes256
This adds support for key unwrapping using the RFC 3394 or RFC
5649 algorithm if the PSKC file uses this.
2014-05-30 Arthur de Jong
* [99ba287] pskc/aeskw.py, tests/test_aeskw.doctest: Implement
padding as specified in RFC 5649
This adds a pad argument with which padding can be forced or
disabled.
2014-05-29 Arthur de Jong
* [ebf8945] pskc/aeskw.py, tests/test_aeskw.doctest: Allow speciying
an initial value for key wrapping
2014-05-29 Arthur de Jong
* [5720fe5] pskc/aeskw.py, pskc/exceptions.py,
tests/test_aeskw.doctest: Provide an RFC 3394 AES key wrapping
algorithm
This also introduces an EncryptionError exception.
2014-05-29 Arthur de Jong
* [7164d89] README, docs/usage.rst, pskc/__init__.py,
tests/rfc6030-figure10.pskcxml, tests/rfc6030-figure2.pskcxml,
tests/rfc6030-figure3.pskcxml, tests/rfc6030-figure4.pskcxml,
tests/rfc6030-figure5.pskcxml, tests/rfc6030-figure6.pskcxml,
tests/rfc6030-figure7.pskcxml, tests/test_rfc6030.doctest:
Always put a space between RFC and number
2014-05-29 Arthur de Jong
* [ccebb69] pskc/encryption.py, tests/test_encryption.doctest,
tests/tripledes-cbc.pskcxml: Support Tripple DES decryption
2014-05-29 Arthur de Jong
* [a11f31f] tests/test_invalid.doctest: Add tests for key derivation
problems
This tests for unknown or missing algorithms and unknown
derivation parameters.
2014-05-29 Arthur de Jong
* [0738c94] pskc/encryption.py, pskc/exceptions.py: Raise exception
when key derivation fails
This also renames the internal function that implements the
derivation.
2014-05-29 Arthur de Jong
* [76ef42b] pskc/encryption.py, pskc/exceptions.py,
tests/invalid-encryption.pskcxml, tests/test_invalid.doctest:
Add test for missing key encryption algorithm
This also introduces a toplevel PSKCError exception that all
exceptions have as parent.
2014-05-29 Arthur de Jong
* [7f26dc6] tests/aes128-cbc.pskcxml, tests/aes192-cbc.pskcxml,
tests/aes256-cbc.pskcxml, tests/test_encryption.doctest: Add
test for all AES-CBC encryption schemes
2014-05-29 Arthur de Jong
* [28f2c1c] pskc/encryption.py: Support more AES-CBC encryption
schemes
This also moves the crypto imports to the places where they are
used to avoid a depenency on pycrypto if no encryption is used.
2014-05-29 Arthur de Jong
* [678b127] tests/test_minimal.doctest: Add test for missing
secret value
2014-05-25 Arthur de Jong
* [bef2f7d] pskc/__init__.py, pskc/key.py,
tests/test_minimal.doctest: Add a function for adding a new key
2014-05-25 Arthur de Jong
* [46f5749] pskc/__init__.py: Consistency improvement
2014-05-25 Arthur de Jong
* [83f5a4b] pskc/__init__.py, tests/test_minimal.doctest: Support
creating an empty PSKC instance
2014-05-25 Arthur de Jong
* [820c83c] pskc/encryption.py, pskc/mac.py: Be more lenient in
accepting algorithms
2014-05-25 Arthur de Jong
* [02bde47] pskc/key.py: Code simplification
2014-05-25 Arthur de Jong
* [b62fec8] pskc/encryption.py, pskc/exceptions.py,
tests/invalid-encryption.pskcxml, tests/test_invalid.doctest,
tests/test_rfc6030.doctest: Raise an exception if decryption fails
2014-05-25 Arthur de Jong
* [7bc2e6b] pskc/encryption.py: Make decryption code better readable
2014-05-23 Arthur de Jong
* [714f387] setup.cfg, tests/invalid-notxml.pskcxml,
tests/invalid-wrongelement.pskcxml,
tests/invalid-wrongversion.pskcxml, tests/test_invalid.doctest:
Add tests for invalid PSKC files
2014-05-23 Arthur de Jong
* [803d24c] pskc/__init__.py, pskc/exceptions.py: Raise exceptions
on some parsing problems
2014-05-23 Arthur de Jong
* [8c37e26] setup.py: Fix install_requires
2014-05-23 Arthur de Jong
* [8e1729e] ChangeLog, MANIFEST.in, NEWS: Get files ready for
0.1 release
2014-05-23 Arthur de Jong
* [15ca643] README, pskc/__init__.py, tests/rfc6030-figure10.pskcxml,
tests/rfc6030-figure2.pskcxml, tests/rfc6030-figure3.pskcxml,
tests/rfc6030-figure4.pskcxml, tests/rfc6030-figure5.pskcxml,
tests/rfc6030-figure6.pskcxml, tests/rfc6030-figure7.pskcxml,
tests/test_rfc6030.doctest: Use pskcxml as file name extension
This is the extension that is suggested in RFC6030.
2014-05-23 Arthur de Jong
* [44c7d2e] docs/policy.rst, docs/usage.rst: Improve IANA links
2014-05-20 Arthur de Jong
* [cda1c5f] tests/test_rfc6030.doctest: Improve test
This tests that, before the PSKC ecnryption is key available,
the secret from the key cannot be extracted.
2014-05-19 Arthur de Jong
* [e96c746] docs/_templates/autosummary/module.rst, docs/conf.py,
docs/encryption.rst, docs/index.rst, docs/mac.rst, docs/policy.rst,
docs/usage.rst: Provide Sphinx documentation
2014-05-18 Arthur de Jong
* [edf4d24] pskc/policy.py: Add missing policy constant
2014-05-18 Arthur de Jong
* [92a994d] pskc/key.py: Fix attribute name in docstring
2014-04-20 Arthur de Jong
* [cc9bbb5] README: Update README
2014-05-17 Arthur de Jong
* [d0a7814] .gitignore, setup.py: Fix dateutil dependency
This also ignores downloaded .egg files.
2014-04-19 Arthur de Jong
* [e0159ba] pskc/parse.py: Fix module description
2014-04-19 Arthur de Jong
* [ba17976] pskc/__init__.py, pskc/parse.py: Move PSKC class to
toplevel module
This also splits the parsing to a parse() function for consistency.
2014-04-19 Arthur de Jong
* [64e207d] pskc/key.py, tests/test_rfc6030.doctest: Provide
pskc.key docstrings
This documents most of the information that is available per
key and adds a few other minor cosmetic changes.
This also re-organises the key properties to be in a slightly more
logical order and renames the userid key property to key_userid
to more clearly distinguish it from device_userid.
2014-04-19 Arthur de Jong
* [6becc61] pskc/parse.py: Provide pskc.parse docstrings
This documents most of the API of the parsing functions and the
PSKC class.
2014-04-19 Arthur de Jong
* [1d42fbc] pskc/policy.py: Complete pskc.policy docstrings
Also contains small consistency improvement.
2014-04-19 Arthur de Jong
* [b07d709] pskc/mac.py: Provide pskc.mac docstrings
This also hides two properties that are not part of the public API.
2014-04-19 Arthur de Jong
* [285860e] pskc/encryption.py: Provide pskc.encryption docstrings
This documents classes in the pskc.encryption module.
2014-04-19 Arthur de Jong
* [8c9e03d] pskc/key.py, pskc/mac.py, pskc/parse.py, pskc/policy.py:
Move Key class to separate module
This also allows re-organising the imports a bit.
2014-04-16 Arthur de Jong
* [c883d48] MANIFEST.in, pskc/__init__.py, setup.cfg, setup.py:
Add initial setup script
2014-04-14 Arthur de Jong
* [3df6849] COPYING: Include a license file (LGPL)
2014-04-13 Arthur de Jong
* [f08cdb5] tests/rfc6030-figure10.pskc, tests/test_rfc6030.doctest:
Add bulk provisioning test from Figure 10
2014-04-13 Arthur de Jong
* [41828cd] pskc/parse.py: Use slightly clearer names
2014-04-12 Arthur de Jong
* [5ab731c] tests/rfc6030-figure7.pskc, tests/test_rfc6030.doctest:
Add test for Figure 7 from RFC6030
This tests encrypted key derivation using PBKDF2 and a pre-shared
passphrase.
2014-04-12 Arthur de Jong
* [a3fd598] pskc/encryption.py: Implement PBKDF2 key derivation
This supports deriving the key from a passphrase and information
present in the DerivedKey and PBKDF2-params XML elements.
2014-04-12 Arthur de Jong
* [2ff470f] pskc/encryption.py: Add id attribute from EncryptionKey
2014-04-12 Arthur de Jong
* [460f335] tests/rfc6030-figure6.pskc, tests/test_rfc6030.doctest:
Add test for Figure 6 from RFC6030
This test key encryption with a pre-shared key and MAC checks.
2014-04-12 Arthur de Jong
* [a926ddb] pskc/mac.py, pskc/parse.py: Implement MAC checking
This implements message message authentication code checking
for the encrypted values if MACMethod and ValueMAC are present.
2014-04-12 Arthur de Jong
* [e53e865] pskc/encryption.py, pskc/parse.py: Support decrypting
with a pre-shared key
This adds an encryption module that provides wrappers for
handling decryption.
2014-04-11 Arthur de Jong
* [3fe0919] pskc/parse.py: Refactor DataType value handling
This ensures that DataType values are retrieved dynamically
instead of at the time the PSKC file was parsed in order to make
decryption work.
2014-04-11 Arthur de Jong
* [591bb5d] pskc/policy.py: Document key and pin usage values
2014-04-11 Arthur de Jong
* [b952b93] tests/rfc6030-figure5.pskc, tests/test_rfc6030.doctest:
Add test for Figure 5 from RFC6030
This test extraction of key policy information and cross-key
references.
2014-04-11 Arthur de Jong
* [e939a96] pskc/parse.py, pskc/policy.py: Implement key policy
parsing
This parses key policy from PSKC files and provides a few utility
methods to help with policy validation.
2014-04-11 Arthur de Jong
* [8c9ac8c] pskc/parse.py: Support parsing date and integer values
2014-04-11 Arthur de Jong
* [6446f7d] tests/rfc6030-figure4.pskc, tests/test_rfc6030.doctest:
Add test for Figure 4 from RFC6030
This tests for key profile and key reference properties that
can be used to reference external keys.
2014-04-07 Arthur de Jong
* [e72369f] tests/rfc6030-figure3.pskc, tests/test_rfc6030.doctest:
Add test for Figure 3 from RFC6030
This tests Figure 3 from RFC6030 with a very basic plain text
secret key and some supplementary data.
2014-04-07 Arthur de Jong
* [2c111a8] pskc/parse.py: Get more data from KeyPackage
This gets most simple string values from the KeyPackage as well
as some integer and boolean values.
2014-04-07 Arthur de Jong
* [96b4b54] tests/rfc6030-figure2.pskc, tests/test-rfc6030.doctest:
Add test for example from RFC6030
This tests Figure 2 from RFC6030 with a very basic plain text
secret key.
2014-04-07 Arthur de Jong
* [d662cf2] pskc/parse.py: Support getting plaintext key
2014-04-07 Arthur de Jong
* [550630d] tests/test_minimal.doctest: Minimal test
This adds a doctest for the absolute minimum PSKC file that does
not contain any useful information.
2014-04-07 Arthur de Jong
* [bf8e7f6] pskc/__init__.py, pskc/parse.py: Basic implementation
of PSKC class
This class is used for handling PSKC files. It will parse the
file and store relevant properties for easy access. The Key
class corresponds to a single key defined in the PSKC file.
This is a very minimal implementation that only provides some
meta-data from the file and keys (work in progress).
2014-04-04 Arthur de Jong
* [9803dfc] README: Provide an initial README
2014-04-02 Arthur de Jong
* [c912bb4] .gitignore, pskc/__init__.py: Initial project layout
python-pskc-0.5/README 0000644 0000000 0000000 00000005212 13040703436 014453 0 ustar root root 0000000 0000000 Python PSKC module
==================
A Python module to handle Portable Symmetric Key Container (PSKC) files as
defined in `RFC 6030 `_. PSKC files are
used to transport and provision symmetric keys and key meta data (seed files)
to different types of crypto modules, commonly one-time password tokens or
other authentication devices.
This module can be used to extract keys from PSKC files for use in an OTP
authentication system. The module can also be used for authoring PSKC files.
http://arthurdejong.org/python-pskc/
API
---
The module provides a straightforward API that is mostly geared towards
parsing existing PSKC files.
Extracting key material from encrypted PSKC files is as simple as:
>>> from pskc import PSKC
>>> pskc = PSKC('tests/rfc6030/figure7.pskcxml')
>>> pskc.encryption.derive_key('qwerty')
>>> for key in pskc.keys:
... print key.serial, key.secret
987654321 12345678901234567890
Writing am encrypted PSKC file is as simple as:
>>> pskc = PSKC()
>>> key = pskc.add_key(
... id='456', secret='987654321', manufacturer='Manufacturer',
... algorithm = 'urn:ietf:params:xml:ns:keyprov:pskc:hotp')
>>> pskc.encryption.setup_pbkdf2('passphrase')
>>> pskc.write('output.pskcxml')
The key object has a number of properties. See the pskc.key.Key documentation
for details.
Security considerations
-----------------------
This code handles private key material and is written in Python. No
precautions have been taken to lock pages in memory to prevent swapping. Also
no attempt is currently made to security dispose of memory that may have held
private key material.
Copyright
---------
Copyright (C) 2014-2017 Arthur de Jong
This library is free software; you can redistribute it and/or
modify it under the terms of the GNU Lesser General Public
License as published by the Free Software Foundation; either
version 2.1 of the License, or (at your option) any later version.
This library is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
Lesser General Public License for more details.
You should have received a copy of the GNU Lesser General Public
License along with this library; if not, write to the Free Software
Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
02110-1301 USA
Development notes
-----------------
This package should use a mostly standard source code layout and support both
Python 2 (2.6 but 2.7 is recommended) and Python 3 (most recent versions
should work). The tests can be run with nosetests and the aim is to have
maximum code coverage.
python-pskc-0.5/MANIFEST.in 0000644 0000000 0000000 00000000204 12605450042 015323 0 ustar root root 0000000 0000000 include README NEWS ChangeLog COPYING *.py
recursive-include tests *.doctest *.py *.pskcxml *.xml
recursive-include docs *.rst *.py
python-pskc-0.5/pskc/ 0000755 0000000 0000000 00000000000 13040717606 014537 5 ustar root root 0000000 0000000 python-pskc-0.5/pskc/encryption.py 0000644 0000000 0000000 00000030545 13040515160 017301 0 ustar root root 0000000 0000000 # encryption.py - module for handling encrypted values
# coding: utf-8
#
# Copyright (C) 2014-2016 Arthur de Jong
#
# This library is free software; you can redistribute it and/or
# modify it under the terms of the GNU Lesser General Public
# License as published by the Free Software Foundation; either
# version 2.1 of the License, or (at your option) any later version.
#
# This library is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
# Lesser General Public License for more details.
#
# You should have received a copy of the GNU Lesser General Public
# License along with this library; if not, write to the Free Software
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
# 02110-1301 USA
"""Module that handles encrypted PSKC values.
This module defines an Encryption class that handles the encryption key,
algorithms and decryption.
The encryption key can be derived using the KeyDerivation class.
"""
def algorithm_key_lengths(algorithm):
"""Return the possible key lengths for the configured algorithm."""
from pskc.exceptions import DecryptionError
if algorithm is None:
raise DecryptionError('No algorithm specified')
elif algorithm.endswith('#aes128-cbc') or \
algorithm.endswith('#aes192-cbc') or \
algorithm.endswith('#aes256-cbc'):
return [int(algorithm[-7:-4]) // 8]
elif algorithm.endswith('#tripledes-cbc') or \
algorithm.endswith('#kw-tripledes'):
from Crypto.Cipher import DES3
return list(DES3.key_size)
elif algorithm.endswith('#kw-aes128') or \
algorithm.endswith('#kw-aes192') or \
algorithm.endswith('#kw-aes256'):
return [int(algorithm[-3:]) // 8]
else:
raise DecryptionError('Unsupported algorithm: %r' % algorithm)
def decrypt(algorithm, key, ciphertext, iv=None):
"""Decrypt the ciphertext and return the plaintext value."""
from pskc.exceptions import DecryptionError
if key is None:
raise DecryptionError('No key available')
if algorithm is None:
raise DecryptionError('No algorithm specified')
if len(key) not in algorithm_key_lengths(algorithm):
raise DecryptionError('Invalid key length')
if algorithm.endswith('#aes128-cbc') or \
algorithm.endswith('#aes192-cbc') or \
algorithm.endswith('#aes256-cbc'):
from Crypto.Cipher import AES
from pskc.crypto import unpad
if not iv:
iv = ciphertext[:AES.block_size]
ciphertext = ciphertext[AES.block_size:]
cipher = AES.new(key, AES.MODE_CBC, iv)
return unpad(cipher.decrypt(ciphertext), AES.block_size)
elif algorithm.endswith('#tripledes-cbc'):
from Crypto.Cipher import DES3
from pskc.crypto import unpad
if not iv:
iv = ciphertext[:DES3.block_size]
ciphertext = ciphertext[DES3.block_size:]
cipher = DES3.new(key, DES3.MODE_CBC, iv)
return unpad(cipher.decrypt(ciphertext), DES3.block_size)
elif algorithm.endswith('#kw-aes128') or \
algorithm.endswith('#kw-aes192') or \
algorithm.endswith('#kw-aes256'):
from pskc.crypto.aeskw import unwrap
return unwrap(ciphertext, key)
elif algorithm.endswith('#kw-tripledes'): # pragma: no branch
from pskc.crypto.tripledeskw import unwrap
return unwrap(ciphertext, key)
# no fallthrough because algorithm_key_lengths() fails with unknown algo
def encrypt(algorithm, key, plaintext, iv=None):
"""Encrypt the provided value with the key using the algorithm."""
from pskc.exceptions import EncryptionError
if key is None:
raise EncryptionError('No key available')
if algorithm is None:
raise EncryptionError('No algorithm specified')
if len(key) not in algorithm_key_lengths(algorithm):
raise EncryptionError('Invalid key length')
if algorithm.endswith('#aes128-cbc') or \
algorithm.endswith('#aes192-cbc') or \
algorithm.endswith('#aes256-cbc'):
from Crypto import Random
from Crypto.Cipher import AES
from pskc.crypto import pad
iv = iv or Random.get_random_bytes(AES.block_size)
cipher = AES.new(key, AES.MODE_CBC, iv)
return iv + cipher.encrypt(pad(plaintext, AES.block_size))
elif algorithm.endswith('#tripledes-cbc'):
from Crypto import Random
from Crypto.Cipher import DES3
from pskc.crypto import pad
iv = iv or Random.get_random_bytes(DES3.block_size)
cipher = DES3.new(key, DES3.MODE_CBC, iv)
return iv + cipher.encrypt(pad(plaintext, DES3.block_size))
elif algorithm.endswith('#kw-aes128') or \
algorithm.endswith('#kw-aes192') or \
algorithm.endswith('#kw-aes256'):
from pskc.crypto.aeskw import wrap
return wrap(plaintext, key)
elif algorithm.endswith('#kw-tripledes'): # pragma: no branch
from pskc.crypto.tripledeskw import wrap
return wrap(plaintext, key)
# no fallthrough because algorithm_key_lengths() fails with unknown algo
class KeyDerivation(object):
"""Handle key derivation.
The algorithm property contains the key derivation algorithm to use. For
PBDKF2 the following parameters are set:
pbkdf2_salt: salt value
pbkdf2_iterations: number of iterations to use
pbkdf2_key_length: required key length in bytes
pbkdf2_prf: name of pseudorandom function used
"""
def __init__(self):
self.algorithm = None
# PBKDF2 properties
self.pbkdf2_salt = None
self.pbkdf2_iterations = None
self.pbkdf2_key_length = None
self.pbkdf2_prf = None
def derive_pbkdf2(self, password):
from Crypto.Protocol.KDF import PBKDF2
from pskc.mac import get_hmac
from pskc.exceptions import KeyDerivationError
prf = None
if self.pbkdf2_prf:
prf = get_hmac(self.pbkdf2_prf)
if prf is None:
raise KeyDerivationError(
'Pseudorandom function unsupported: %r' %
self.pbkdf2_prf)
if not all((password, self.pbkdf2_salt, self.pbkdf2_key_length,
self.pbkdf2_iterations)):
raise KeyDerivationError('Incomplete PBKDF2 configuration')
return PBKDF2(
password, self.pbkdf2_salt, dkLen=self.pbkdf2_key_length,
count=self.pbkdf2_iterations, prf=prf)
def derive(self, password):
"""Derive a key from the password."""
from pskc.exceptions import KeyDerivationError
if self.algorithm is None:
raise KeyDerivationError('No algorithm specified')
if self.algorithm.endswith('#pbkdf2'):
return self.derive_pbkdf2(password)
else:
raise KeyDerivationError(
'Unsupported algorithm: %r' % self.algorithm)
def setup_pbkdf2(self, password, salt=None, salt_length=16,
key_length=None, iterations=None, prf=None):
from Crypto import Random
from pskc.algorithms import normalise_algorithm
self.algorithm = normalise_algorithm('pbkdf2')
if salt is None:
salt = Random.get_random_bytes(salt_length)
self.pbkdf2_salt = salt
if iterations:
self.pbkdf2_iterations = iterations
elif self.pbkdf2_iterations is None:
self.pbkdf2_iterations = 12 * 1000
if key_length: # pragma: no branch (always specified)
self.pbkdf2_key_length = key_length
if prf:
self.pbkdf2_prf = normalise_algorithm(prf)
return self.derive_pbkdf2(password)
class Encryption(object):
"""Class for handling encryption keys that are used in the PSKC file.
Encryption generally uses a symmetric key that is used to encrypt some
of the information stored in PSKC files (typically the seed). This
class provides the following values:
id: identifier of the key
algorithm: the encryption algorithm used
key_names: list of names for the key
key_name: (first) name of the key (usually there is only one)
key: the key value itself (binary form)
iv: optional initialization vector for CBC based encryption
fields: a list of Key fields that will be encrypted on writing
The key can either be assigned to the key property or derived using the
derive_key() method.
"""
def __init__(self, pskc):
self.pskc = pskc
self.id = None
self._algorithm = None
self.key_names = []
self.key = None
self.iv = None
self.derivation = KeyDerivation()
self.fields = []
@property
def key_name(self):
"""Provide the name of the (first) key."""
if self.key_names:
return self.key_names[0]
@key_name.setter
def key_name(self, value):
self.key_names = [value]
@property
def algorithm(self):
"""Provide the encryption algorithm used."""
if self._algorithm:
return self._algorithm
@algorithm.setter
def algorithm(self, value):
from pskc.algorithms import normalise_algorithm
self._algorithm = normalise_algorithm(value)
def derive_key(self, password):
"""Derive a key from the password."""
self.key = self.derivation.derive(password)
def _setup_encryption(self, kwargs):
for k in ('id', 'algorithm', 'key_name', 'key_names', 'fields'):
v = kwargs.pop(k, None)
if v is not None:
setattr(self, k, v)
# default encryption to AES128-CBC
if not self.algorithm:
self.algorithm = 'aes128-cbc'
# default to encrypting the secret only
if not self.fields:
self.fields = ['secret', ]
# if we're using a CBC mode of encryption, add a MAC
if self.algorithm.endswith('-cbc'):
self.pskc.mac.setup()
def setup_preshared_key(self, **kwargs):
"""Configure pre-shared key encryption when writing the file.
The following arguments may be supplied:
key: the encryption key to use
id: encryption key identifier
algorithm: encryption algorithm
key_length: encryption key length in bytes
key_name: a name for the key
key_names: a number of names for the key
fields: a list of fields to encrypt
None of the arguments are required, reasonable defaults will be
chosen for missing arguments.
"""
self._setup_encryption(kwargs)
self.key = kwargs.pop('key', self.key)
if not self.key:
from Crypto import Random
self.key = Random.get_random_bytes(kwargs.pop(
'key_length', self.algorithm_key_lengths[-1]))
def setup_pbkdf2(self, password, **kwargs):
"""Configure password-based PSKC encryption when writing the file.
The following arguments may be supplied:
password: the password to use (required)
id: encryption key identifier
algorithm: encryption algorithm
key_length: encryption key length in bytes
key_name: a name for the key
key_names: a number of names for the key
fields: a list of fields to encrypt
salt: PBKDF2 salt
salt_length: used when generating random salt
iterations: number of PBKDF2 iterations
prf: PBKDF2 pseudorandom function
Only password is required, for the other arguments reasonable
defaults will be chosen.
"""
self._setup_encryption(kwargs)
# pass a key length to PBKDF2
kwargs.setdefault('key_length', self.algorithm_key_lengths[-1])
self.key = self.derivation.setup_pbkdf2(password, **kwargs)
@property
def algorithm_key_lengths(self):
"""Provide the possible key lengths for the configured algorithm."""
return algorithm_key_lengths(self.algorithm)
def decrypt_value(self, cipher_value, algorithm=None):
"""Decrypt the cipher_value and return the plaintext value."""
return decrypt(
algorithm or self.algorithm, self.key, cipher_value, self.iv)
def encrypt_value(self, plaintext):
"""Encrypt the provided value and return the cipher_value."""
return encrypt(self.algorithm, self.key, plaintext, self.iv)
python-pskc-0.5/pskc/exceptions.py 0000644 0000000 0000000 00000002760 12354352405 017276 0 ustar root root 0000000 0000000 # exceptions.py - collection of pskc exceptions
# coding: utf-8
#
# Copyright (C) 2014 Arthur de Jong
#
# This library is free software; you can redistribute it and/or
# modify it under the terms of the GNU Lesser General Public
# License as published by the Free Software Foundation; either
# version 2.1 of the License, or (at your option) any later version.
#
# This library is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
# Lesser General Public License for more details.
#
# You should have received a copy of the GNU Lesser General Public
# License along with this library; if not, write to the Free Software
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
# 02110-1301 USA
"""Collection of exceptions."""
class PSKCError(Exception):
"""General top-level exception."""
pass
class ParseError(PSKCError):
"""Something went wrong with parsing the PSKC file.
Either the file is invalid XML or required elements or attributes are
missing."""
pass
class EncryptionError(PSKCError):
"""There was a problem encrypting the value."""
pass
class DecryptionError(PSKCError):
"""There was a problem decrypting the value.
The encrypted value as available but something went wrong with decrypting
it."""
pass
class KeyDerivationError(PSKCError):
"""There was a problem performing the key derivation."""
pass
python-pskc-0.5/pskc/parser.py 0000644 0000000 0000000 00000030644 13040703437 016411 0 ustar root root 0000000 0000000 # parser.py - PSKC file parsing functions
# coding: utf-8
#
# Copyright (C) 2016-2017 Arthur de Jong
#
# This library is free software; you can redistribute it and/or
# modify it under the terms of the GNU Lesser General Public
# License as published by the Free Software Foundation; either
# version 2.1 of the License, or (at your option) any later version.
#
# This library is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
# Lesser General Public License for more details.
#
# You should have received a copy of the GNU Lesser General Public
# License along with this library; if not, write to the Free Software
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
# 02110-1301 USA
"""Module for parsing PSKC files."""
from pskc.algorithms import normalise_algorithm
from pskc.exceptions import ParseError
from pskc.xml import (
find, findall, findbin, findint, findtext, findtime, getbool, getint,
parse, remove_namespaces)
class PSKCParser(object):
@classmethod
def parse_file(cls, pskc, filename):
try:
tree = parse(filename)
except Exception:
raise ParseError('Error parsing XML')
remove_namespaces(tree)
cls.parse_document(pskc, tree.getroot())
@classmethod
def parse_document(cls, pskc, container):
"""Read information from the provided tree."""
if container.tag != 'KeyContainer':
raise ParseError('Missing KeyContainer')
# the version of the PSKC schema
pskc.version = container.get('Version') or container.get('version')
if pskc.version and pskc.version not in ('1', '1.0'):
raise ParseError('Unsupported version %r' % pskc.version)
# unique identifier for the container
pskc.id = (
container.get('Id') or container.get('ID') or container.get('id'))
# handle EncryptionKey entries
cls.parse_encryption(pskc.encryption, find(
container, 'EncryptionKey', 'EncryptionMethod'))
# handle MACMethod entries
cls.parse_mac_method(pskc.mac, find(
container, 'MACMethod', 'DigestMethod'))
# fall back to MACAlgorithm
mac_algorithm = findtext(container, 'MACAlgorithm')
if mac_algorithm:
pskc.mac.algorithm = mac_algorithm
# handle KeyPackage entries
for key_package in findall(container, 'KeyPackage', 'Device'):
cls.parse_key_package(pskc.add_device(), key_package)
@classmethod
def parse_encryption(cls, encryption, key_info):
"""Read encryption information from the XML tree."""
if key_info is None:
return
encryption.id = key_info.get('Id')
encryption.algorithm = (
key_info.get('Algorithm') or encryption.algorithm)
for name in findall(key_info,
'KeyName', 'DerivedKey/MasterKeyName',
'DerivedKey/CarriedKeyName'):
encryption.key_names.append(findtext(name, '.'))
encryption.iv = findbin(key_info, 'IV') or encryption.iv
cls.parse_key_derivation(encryption.derivation, find(
key_info, 'DerivedKey/KeyDerivationMethod'))
@classmethod
def parse_key_derivation(cls, derivation, key_derivation):
"""Read derivation parameters from a element."""
if key_derivation is None:
return
derivation.algorithm = key_derivation.get('Algorithm')
# PBKDF2 properties
pbkdf2 = find(key_derivation, 'PBKDF2-params')
if pbkdf2 is not None:
# get used salt
derivation.pbkdf2_salt = findbin(pbkdf2, 'Salt/Specified')
# required number of iterations
derivation.pbkdf2_iterations = findint(pbkdf2, 'IterationCount')
# key length
derivation.pbkdf2_key_length = findint(pbkdf2, 'KeyLength')
# pseudorandom function used
prf = find(pbkdf2, 'PRF')
if prf is not None:
derivation.pbkdf2_prf = normalise_algorithm(
prf.get('Algorithm'))
@classmethod
def parse_mac_method(cls, mac, mac_method):
"""Read MAC information from the XML tree."""
if mac_method is None:
return
mac.algorithm = mac_method.get('Algorithm')
mac_key = find(mac_method, 'MACKey')
if mac_key is not None:
mac.key_algorithm, mac.key_cipher_value = (
cls.parse_encrypted_value(mac_key))
@classmethod
def parse_key_package(cls, device, key_package):
"""Read key information from the provided tree."""
info = find(key_package, 'DeviceInfo', 'DeviceId')
if info is not None:
device.manufacturer = findtext(info, 'Manufacturer')
device.serial = findtext(info, 'SerialNo')
device.model = findtext(info, 'Model')
device.issue_no = findtext(info, 'IssueNo')
device.device_binding = findtext(info, 'DeviceBinding')
device.start_date = findtime(info, 'StartDate')
device.expiry_date = findtime(info, 'ExpiryDate')
device.device_userid = findtext(info, 'UserId')
device.crypto_module = findtext(key_package, 'CryptoModuleInfo/Id')
for key_elm in findall(key_package, 'Key'):
cls.parse_key(device.add_key(), key_elm)
@classmethod
def parse_key(cls, key, key_elm):
"""Read key information from the provided tree."""
key.id = key_elm.get('Id') or key_elm.get('KeyId')
key.algorithm = key_elm.get('Algorithm') or key_elm.get('KeyAlgorithm')
data = find(key_elm, 'Data')
if data is not None:
cls.parse_datatype(key._secret, find(data, 'Secret'))
cls.parse_datatype(key._counter, find(data, 'Counter'))
cls.parse_datatype(key._time_offset, find(data, 'Time'))
cls.parse_datatype(key._time_interval, find(data, 'TimeInterval'))
cls.parse_datatype(key._time_drift, find(data, 'TimeDrift'))
for data in findall(key_elm, 'Data'):
name = data.get('Name')
if name:
cls.parse_datatype(dict(
secret=key._secret, counter=key._counter,
time=key._time_offset, time_interval=key._time_interval
).get(name.lower()), data)
key.issuer = findtext(key_elm, 'Issuer')
key.key_profile = findtext(key_elm, 'KeyProfileId')
key.key_reference = findtext(key_elm, 'KeyReference')
key.friendly_name = findtext(key_elm, 'FriendlyName')
# TODO: support multi-language values of
key.key_userid = findtext(key_elm, 'UserId')
key.algorithm_suite = findtext(
key_elm, 'AlgorithmParameters/Suite')
challenge_format = find(
key_elm,
'AlgorithmParameters/ChallengeFormat', 'Usage/ChallengeFormat')
if challenge_format is not None:
key.challenge_encoding = (
challenge_format.get('Encoding') or
challenge_format.get('Format'))
key.challenge_min_length = getint(challenge_format, 'Min')
key.challenge_max_length = getint(challenge_format, 'Max')
key.challenge_check = getbool(
challenge_format, 'CheckDigits', getbool(
challenge_format, 'CheckDigit'))
response_format = find(
key_elm,
'AlgorithmParameters/ResponseFormat', 'Usage/ResponseFormat')
if response_format is not None:
key.response_encoding = (
response_format.get('Encoding') or
response_format.get('Format'))
key.response_length = getint(response_format, 'Length')
key.response_check = getbool(
response_format, 'CheckDigits', getbool(
response_format, 'CheckDigit'))
cls.parse_policy(key.policy, find(key_elm, 'Policy'))
usage = find(key_elm, 'Usage')
if usage is not None:
for att in ('OTP', 'CR', 'Integrity', 'Encrypt', 'Unlock'):
if getbool(usage, att):
key.policy.key_usage.append(att)
key.policy.start_date = (
findtime(key_elm, 'StartDate') or key.policy.start_date)
key.policy.expiry_date = (
findtime(key_elm, 'ExpiryDate') or key.policy.expiry_date)
@classmethod
def parse_encrypted_value(cls, encrypted_value):
"""Read encryption value from element."""
algorithm = None
cipher_value = findbin(encrypted_value, 'CipherData/CipherValue')
encryption_method = find(encrypted_value, 'EncryptionMethod')
if encryption_method is not None:
algorithm = encryption_method.attrib.get('Algorithm')
encryption_scheme = find(
encrypted_value, 'EncryptionMethod/EncryptionScheme')
if encryption_scheme is not None:
algorithm = encryption_scheme.attrib.get('Algorithm') or algorithm
return (algorithm, cipher_value)
@classmethod
def parse_datatype(cls, dt, element):
"""Read information from the provided element.
The element is expected to contain ,
and/or elements that contain information on the actual
value."""
if element is None:
return
# read plaintext value from
plain_value = findtext(element, 'PlainValue')
if plain_value is not None:
dt.value = dt._from_text(plain_value)
# read encrypted data from
encrypted_value = find(element, 'EncryptedValue')
if encrypted_value is not None:
dt.algorithm, dt.cipher_value = cls.parse_encrypted_value(
encrypted_value)
# store the found algorithm in the pskc.encryption property
if not dt.pskc.encryption.algorithm and dt.algorithm:
dt.pskc.encryption.algorithm = dt.algorithm
# read MAC information from
value_mac = findbin(element, 'ValueMAC', 'ValueDigest')
if value_mac is not None:
dt.value_mac = value_mac
# read legacy elements (can be plain or encrypted)
value = find(element, 'Value')
if value is not None:
if dt.pskc.encryption.algorithm and dt.value_mac:
dt.cipher_value = findbin(element, 'Value')
else:
dt.value = dt._from_text(findtext(element, 'Value'))
@classmethod
def parse_policy(cls, policy, policy_elm):
"""Read key policy information from the provided tree."""
if policy_elm is None:
return
policy.start_date = findtime(policy_elm, 'StartDate')
policy.expiry_date = findtime(policy_elm, 'ExpiryDate')
policy.number_of_transactions = findint(
policy_elm, 'NumberOfTransactions')
for key_usage in findall(policy_elm, 'KeyUsage'):
policy.key_usage.append(findtext(key_usage, '.'))
pin_policy_elm = find(policy_elm, 'PINPolicy')
if pin_policy_elm is not None:
policy.pin_key_id = pin_policy_elm.get('PINKeyId')
policy.pin_usage = pin_policy_elm.get('PINUsageMode')
policy.pin_max_failed_attemtps = getint(
pin_policy_elm, 'MaxFailedAttempts')
policy.pin_min_length = getint(pin_policy_elm, 'MinLength')
policy.pin_max_length = getint(pin_policy_elm, 'MaxLength')
policy.pin_encoding = pin_policy_elm.get('PINEncoding')
# check for child elements
if list(pin_policy_elm):
policy.unknown_policy_elements = True
# check for unknown attributes
known_attributes = set([
'PINKeyId', 'PINUsageMode', 'MaxFailedAttempts', 'MinLength',
'MaxLength', 'PINEncoding'])
if set(pin_policy_elm.keys()) - known_attributes:
policy.unknown_policy_elements = True
# check for other child elements
known_children = set([
'StartDate', 'ExpiryDate', 'NumberOfTransactions', 'KeyUsage',
'PINPolicy'])
for child in policy_elm:
if child.tag not in known_children:
policy.unknown_policy_elements = True
python-pskc-0.5/pskc/policy.py 0000644 0000000 0000000 00000012434 13036777211 016417 0 ustar root root 0000000 0000000 # policy.py - module for handling PSKC policy information
# coding: utf-8
#
# Copyright (C) 2014-2016 Arthur de Jong
#
# This library is free software; you can redistribute it and/or
# modify it under the terms of the GNU Lesser General Public
# License as published by the Free Software Foundation; either
# version 2.1 of the License, or (at your option) any later version.
#
# This library is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
# Lesser General Public License for more details.
#
# You should have received a copy of the GNU Lesser General Public
# License along with this library; if not, write to the Free Software
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
# 02110-1301 USA
"""Module that provides PSKC key policy information."""
def _make_aware(d):
"""Make tge specified datetime timezone aware."""
import dateutil.tz
if not d.tzinfo:
return d.replace(tzinfo=dateutil.tz.tzlocal())
return d
class Policy(object):
"""Representation of a policy that describes key and pin usage.
Instances of this class provide attributes that describe limits that
are placed on key usage and requirements for key PIN protection. The
policy provides the following attributes:
start_date: the key MUST not be used before this datetime
expiry_date: the key MUST not be used after this datetime
number_of_transactions: maximum number of times the key may be used
key_usage: list of valid usage scenarios for the key (e.g. OTP)
pin_key_id: id of to the key that holds the PIN
pin_key: reference to the key that holds the PIN
pin: value of the PIN to use
pin_usage: define how the PIN is used in relation to the key
pin_max_failed_attemtps: max. number of times a wrong PIN may be entered
pin_min_length: minimum length of a PIN that may be set
pin_max_length: maximum length of a PIN that may be set
pin_encoding: DECIMAL/HEXADECIMAL/ALPHANUMERIC/BASE64/BINARY
unknown_policy_elements: True if the policy contains unsupported rules
If unknown_policy_elements is True the recipient MUST assume that key
usage is not permitted.
"""
# Key is used for OTP generation.
KEY_USE_OTP = 'OTP'
# Key is used for Challenge/Response purposes.
KEY_USE_CR = 'CR'
# Key is used for data encryption purposes.
KEY_USE_ENCRYPT = 'Encrypt'
# For generating keyed message digests.
KEY_USE_INTEGRITY = 'Integrity'
# For checking keyed message digests.
KEY_USE_VERIFY = 'Verify'
# Unlocking device when wrong PIN has been entered too many times.
KEY_USE_UNLOCK = 'Unlock'
# Key is used for data decryption purposes.
KEY_USE_DECRYPT = 'Decrypt'
# The key is used for key wrap purposes.
KEY_USE_KEYWRAP = 'KeyWrap'
# The key is used for key unwrap purposes.
KEY_USE_UNWRAP = 'Unwrap'
# Use in a key derivation function to derive a new key.
KEY_USE_DERIVE = 'Derive'
# Generate a new key based on a random number and the previous value.
KEY_USE_GENERATE = 'Generate'
# The PIN is checked on the device before the key is used.
PIN_USE_LOCAL = 'Local'
# The response has the PIN prepanded and needs to be checked.
PIN_USE_PREPEND = 'Prepend'
# The response has the PIN appended and needs to be checked.
PIN_USE_APPEND = 'Append'
# The PIN is used in the algorithm computation.
PIN_USE_ALGORITHMIC = 'Algorithmic'
def __init__(self, key=None):
"""Create a new policy, optionally linked to the key and parsed."""
self.key = key
self.start_date = None
self.expiry_date = None
self.number_of_transactions = None
self.key_usage = []
self.pin_key_id = None
self.pin_usage = None
self.pin_max_failed_attemtps = None
self.pin_min_length = None
self.pin_max_length = None
self.pin_encoding = None
self.unknown_policy_elements = False
def may_use(self, usage=None, now=None):
"""Check whether the key may be used for the provided purpose."""
import datetime
import dateutil.tz
if self.unknown_policy_elements:
return False
if usage is not None and self.key_usage:
if usage not in self.key_usage:
return False
# check start_date and expiry_date
if now is None:
now = datetime.datetime.now(dateutil.tz.tzlocal())
if self.start_date:
if _make_aware(self.start_date) > _make_aware(now):
return False # not-yet usable key
if self.expiry_date:
if _make_aware(self.expiry_date) < _make_aware(now):
return False # not-yet usable key
return True
@property
def pin_key(self):
"""Reference to the PSKC Key that holds the PIN (if any)."""
if self.pin_key_id and self.key and self.key.device.pskc:
for key in self.key.device.pskc.keys:
if key.id == self.pin_key_id:
return key
@property
def pin(self):
"""PIN value referenced by PINKeyId if any."""
key = self.pin_key
if key:
return str(key.secret.decode())
python-pskc-0.5/pskc/key.py 0000644 0000000 0000000 00000023163 13037001215 015672 0 ustar root root 0000000 0000000 # key.py - module for handling keys from pskc files
# coding: utf-8
#
# Copyright (C) 2014-2016 Arthur de Jong
#
# This library is free software; you can redistribute it and/or
# modify it under the terms of the GNU Lesser General Public
# License as published by the Free Software Foundation; either
# version 2.1 of the License, or (at your option) any later version.
#
# This library is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
# Lesser General Public License for more details.
#
# You should have received a copy of the GNU Lesser General Public
# License along with this library; if not, write to the Free Software
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
# 02110-1301 USA
"""Module that handles keys stored in PSKC files."""
import array
import base64
import binascii
from pskc.policy import Policy
class DataType(object):
"""Provide access to possibly encrypted, MAC'ed information.
This class is meant to be subclassed to provide typed access to stored
values. Instances of this class provide the following attributes:
value: unencrypted value
cipher_value: encrypted value
algorithm: encryption algorithm of encrypted value
value_mac: MAC of the encrypted value
"""
def __init__(self, pskc):
self.pskc = pskc
self.value = None
self.cipher_value = None
self.algorithm = None
self.value_mac = None
@staticmethod
def _from_text(value):
"""Convert the plain value to native representation."""
raise NotImplementedError # pragma: no cover
@staticmethod
def _from_bin(value):
"""Convert the unencrypted binary to native representation."""
raise NotImplementedError # pragma: no cover
@staticmethod
def _to_text(value):
"""Convert the value to an unencrypted string representation."""
raise NotImplementedError # pragma: no cover
def get_value(self):
"""Provide the attribute value, decrypting as needed."""
from pskc.exceptions import DecryptionError
if self.value is not None:
return self.value
if self.cipher_value:
plaintext = self.pskc.encryption.decrypt_value(
self.cipher_value, self.algorithm)
# allow MAC over plaintext or cipertext
# (RFC6030 implies MAC over ciphertext but older draft used
# MAC over plaintext)
if self.value_mac and self.value_mac not in (
self.pskc.mac.generate_mac(self.cipher_value),
self.pskc.mac.generate_mac(plaintext)):
raise DecryptionError('MAC value does not match')
return self._from_bin(plaintext)
def set_value(self, value):
"""Set the unencrypted value."""
self.value = value
self.cipher_value = None
self.algorithm = None
self.value_mac = None
class BinaryDataType(DataType):
"""Subclass of DataType for binary data (e.g. keys)."""
@staticmethod
def _from_text(value):
"""Convert the plain value to native representation."""
return base64.b64decode(value)
@staticmethod
def _from_bin(value):
"""Convert the unencrypted binary to native representation."""
return value
@staticmethod
def _to_text(value):
"""Convert the value to an unencrypted string representation."""
# force conversion to bytestring on Python 3
if not isinstance(value, type(b'')):
value = value.encode() # pragma: no cover (Python 3 specific)
return base64.b64encode(value).decode()
@staticmethod
def _to_bin(value):
"""Convert the value to binary representation for encryption."""
# force conversion to bytestring on Python 3
if not isinstance(value, type(b'')):
value = value.encode() # pragma: no cover (Python 3 specific)
return value
class IntegerDataType(DataType):
"""Subclass of DataType for integer types (e.g. counters)."""
@staticmethod
def _from_text(value):
"""Convert the plain value to native representation."""
# try normal integer string parsing
try:
return int(value)
except ValueError:
pass
# fall back to base64 decoding
return IntegerDataType._from_bin(base64.b64decode(value))
@staticmethod
def _from_bin(value):
"""Convert the unencrypted binary to native representation."""
# try to handle value as ASCII representation
if value.isdigit():
return int(value)
# fall back to do big-endian decoding
result = 0
for x in array.array('B', value):
result = (result << 8) + x
return result
@staticmethod
def _to_text(value):
"""Convert the value to an unencrypted string representation."""
return str(value)
@staticmethod
def _to_bin(value):
"""Convert the value to binary representation for encryption."""
value = '%x' % value
n = len(value)
return binascii.unhexlify(value.zfill(n + (n & 1)))
class DataTypeProperty(object):
"""A data descriptor that delegates actions to DataType instances."""
def __init__(self, name, doc):
self.name = name
self.__doc__ = doc
def __get__(self, obj, objtype):
return getattr(obj, '_' + self.name).get_value()
def __set__(self, obj, val):
getattr(obj, '_' + self.name).set_value(val)
class DeviceProperty(object):
"""A data descriptor that delegates actions to the Device instance."""
def __init__(self, name):
self.name = name
def __get__(self, obj, objtype):
return getattr(obj.device, self.name)
def __set__(self, obj, val):
setattr(obj.device, self.name, val)
class Key(object):
"""Representation of a single key from a PSKC file.
Instances of this class provide the following properties:
id: unique key identifier (should be constant between interchanges)
algorithm: identifier of the PSKC algorithm profile (URI)
secret: the secret key itself (binary form, automatically decrypted)
counter: event counter for event-based OTP
time_offset: time offset for time-based OTP algorithms (in intervals)
time_interval: time interval for time-based OTP in seconds
time_drift: device clock drift (negative means device is slow)
issuer: party that issued the key
key_profile: reference to pre-shared key profile information
key_reference: reference to an external key
friendly_name: human-readable name for the secret key
key_userid: user distinguished name associated with the key
algorithm_suite: additional algorithm characteristics (e.g. used hash)
challenge_encoding: format of the challenge for CR devices
challenge_min_length: minimum accepted challenge length by device
challenge_max_length: maximum size challenge accepted by the device
challenge_check: whether the device will check an embedded check digit
response_encoding: format of the response the device will generate
response_length: the length of the response of the device
response_check: whether the device appends a Luhn check digit
policy: reference to policy information (see Policy class)
This class also provides access to the manufacturer, serial, model,
issue_no, device_binding, start_date, expiry_date, device_userid and
crypto_module properties of the Device class.
"""
def __init__(self, device):
self.device = device
self.id = None
self.algorithm = None
self._secret = BinaryDataType(self.device.pskc)
self._counter = IntegerDataType(self.device.pskc)
self._time_offset = IntegerDataType(self.device.pskc)
self._time_interval = IntegerDataType(self.device.pskc)
self._time_drift = IntegerDataType(self.device.pskc)
self.issuer = None
self.key_profile = None
self.key_reference = None
self.friendly_name = None
self.key_userid = None
self.algorithm_suite = None
self.challenge_encoding = None
self.challenge_min_length = None
self.challenge_max_length = None
self.challenge_check = None
self.response_encoding = None
self.response_length = None
self.response_check = None
self.policy = Policy(self)
secret = DataTypeProperty(
'secret', 'The secret key itself.')
counter = DataTypeProperty(
'counter', 'An event counter for event-based OTP.')
time_offset = DataTypeProperty(
'time_offset',
'A time offset for time-based OTP (number of intervals).')
time_interval = DataTypeProperty(
'time_interval', 'A time interval in seconds.')
time_drift = DataTypeProperty(
'time_drift', 'Device clock drift value (number of time intervals).')
manufacturer = DeviceProperty('manufacturer')
serial = DeviceProperty('serial')
model = DeviceProperty('model')
issue_no = DeviceProperty('issue_no')
device_binding = DeviceProperty('device_binding')
start_date = DeviceProperty('start_date')
expiry_date = DeviceProperty('expiry_date')
device_userid = DeviceProperty('device_userid')
crypto_module = DeviceProperty('crypto_module')
def check(self):
"""Check if all MACs in the message are valid."""
if all(x is not False for x in (
self.secret, self.counter, self.time_offset,
self.time_interval, self.time_drift)):
return True
python-pskc-0.5/pskc/__init__.py 0000644 0000000 0000000 00000010416 13040703437 016647 0 ustar root root 0000000 0000000 # __init__.py - main module
# coding: utf-8
#
# Copyright (C) 2014-2017 Arthur de Jong
#
# This library is free software; you can redistribute it and/or
# modify it under the terms of the GNU Lesser General Public
# License as published by the Free Software Foundation; either
# version 2.1 of the License, or (at your option) any later version.
#
# This library is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
# Lesser General Public License for more details.
#
# You should have received a copy of the GNU Lesser General Public
# License along with this library; if not, write to the Free Software
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
# 02110-1301 USA
"""Python module for handling PSKC files
This Python library handles Portable Symmetric Key Container (PSKC) files as
defined in RFC 6030. PSKC files are used to transport and provision symmetric
keys (seed files) to different types of crypto modules, commonly one-time
password tokens or other authentication devices.
This module can be used to extract keys from PSKC files for use in an OTP
authentication system. The module can also be used for authoring PSKC files.
The following prints all keys, decrypting using a password:
>>> from pskc import PSKC
>>> pskc = PSKC('tests/rfc6030/figure7.pskcxml')
>>> pskc.encryption.derive_key('qwerty')
>>> for key in pskc.keys:
... print('%s %s' % (key.serial, str(key.secret.decode())))
987654321 12345678901234567890
The following generates an encrypted PSKC file:
>>> pskc = PSKC()
>>> key = pskc.add_key(
... id='456', secret='987654321', manufacturer='Manufacturer',
... algorithm = 'urn:ietf:params:xml:ns:keyprov:pskc:hotp')
>>> pskc.encryption.setup_pbkdf2('passphrase')
>>> pskc.write('output.pskcxml')
The module should be able to handle most common PSKC files.
"""
__all__ = ['PSKC', '__version__']
# the version number of the library
__version__ = '0.5'
class PSKC(object):
"""Wrapper module for parsing a PSKC file.
Instances of this class provide the following attributes:
version: the PSKC format version used (1.0)
id: identifier
encryption: information on used encryption (Encryption instance)
mac: information on used MAC method (MAC instance)
devices: list of devices (Device instances)
keys: list of keys (Key instances)
"""
def __init__(self, filename=None):
from pskc.encryption import Encryption
from pskc.mac import MAC
self.version = None
self.id = None
self.encryption = Encryption(self)
self.mac = MAC(self)
self.devices = []
if filename is not None:
from pskc.parser import PSKCParser
PSKCParser.parse_file(self, filename)
else:
self.version = '1.0'
@property
def keys(self):
return tuple(key for device in self.devices for key in device.keys)
def add_device(self, **kwargs):
"""Create a new device instance for the PSKC file.
The device is initialised with properties from the provided keyword
arguments if any."""
from pskc.device import Device
device = Device(self)
self.devices.append(device)
# assign the kwargs as key properties
for k, v in kwargs.items():
if not hasattr(device, k):
raise AttributeError()
setattr(device, k, v)
return device
def add_key(self, **kwargs):
"""Create a new key instance for the PSKC file.
The new key is initialised with properties from the provided keyword
arguments if any."""
device = self.add_device()
key = device.add_key()
# assign the kwargs as key properties
for k, v in kwargs.items():
if not hasattr(key, k):
raise AttributeError()
setattr(key, k, v)
return key
def write(self, filename):
"""Write the PSKC file to the provided file."""
from pskc.serialiser import PSKCSerialiser
if hasattr(filename, 'write'):
PSKCSerialiser.serialise_file(self, filename)
else:
with open(filename, 'wb') as output:
self.write(output)
python-pskc-0.5/pskc/xml.py 0000644 0000000 0000000 00000013377 13040515160 015713 0 ustar root root 0000000 0000000 # xml.py - module for parsing and writing XML for PSKC files
# coding: utf-8
#
# Copyright (C) 2014-2016 Arthur de Jong
#
# This library is free software; you can redistribute it and/or
# modify it under the terms of the GNU Lesser General Public
# License as published by the Free Software Foundation; either
# version 2.1 of the License, or (at your option) any later version.
#
# This library is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
# Lesser General Public License for more details.
#
# You should have received a copy of the GNU Lesser General Public
# License along with this library; if not, write to the Free Software
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
# 02110-1301 USA
"""Module for parsing XML in PSKC files.
This module provides some utility functions for parsing XML files.
"""
from __future__ import absolute_import
# try to find a usable ElementTree module
try:
from lxml import etree
except ImportError: # pragma: no cover (different implementations)
import xml.etree.ElementTree as etree
# the relevant XML namespaces for PSKC
namespaces = dict(
# the XML namespace URI for version 1.0 of PSKC
pskc='urn:ietf:params:xml:ns:keyprov:pskc',
# the XML Signature namespace
ds='http://www.w3.org/2000/09/xmldsig#',
# the XML Encryption namespace
xenc='http://www.w3.org/2001/04/xmlenc#',
# the XML Encryption version 1.1 namespace
xenc11='http://www.w3.org/2009/xmlenc11#',
# the PKCS #5 namespace
pkcs5='http://www.rsasecurity.com/rsalabs/pkcs/schemas/pkcs-5v2-0#',
)
# register the namespaces so the correct short names will be used
for ns, namespace in namespaces.items():
etree.register_namespace(ns, namespace)
def parse(source):
"""Parse the provided file and return an element tree."""
return etree.parse(source)
def remove_namespaces(tree):
"""Remove namespaces from all elements in the tree."""
import re
for elem in tree.getiterator():
if isinstance(elem.tag, ''.__class__): # pragma: no branch
elem.tag = re.sub(r'^\{[^}]*\}', '', elem.tag)
def findall(tree, *matches):
"""Find the child elements."""
for match in matches:
for element in tree.findall(match, namespaces=namespaces):
yield element
def find(tree, *matches):
"""Find a child element that matches any of the patterns (or None)."""
try:
return next(findall(tree, *matches))
except StopIteration:
pass
def findtext(tree, *matches):
"""Get the text value of an element (or None)."""
element = find(tree, *matches)
if element is not None:
return element.text.strip()
def findint(tree, *matches):
"""Return an element value as an int (or None)."""
value = findtext(tree, *matches)
if value:
return int(value)
def findtime(tree, *matches):
"""Return an element value as a datetime (or None)."""
value = findtext(tree, *matches)
if value:
import dateutil.parser
return dateutil.parser.parse(value)
def findbin(tree, *matches):
"""Return the binary element value base64 decoded."""
value = findtext(tree, *matches)
if value:
import base64
return base64.b64decode(value)
def getint(tree, attribute):
"""Return an attribute value as an integer (or None)."""
value = tree.get(attribute)
if value:
return int(value)
def getbool(tree, attribute, default=None):
"""Return an attribute value as a boolean (or None)."""
value = tree.get(attribute)
if value:
value = value.lower()
if value in ('1', 'true'):
return True
elif value in ('0', 'false'):
return False
else:
raise ValueError('invalid boolean value: %r' % value)
return default
def _format(value):
import datetime
if isinstance(value, datetime.datetime):
value = value.isoformat()
if value.endswith('+00:00'):
value = value[:-6] + 'Z'
return value
elif value is True:
return 'true'
elif value is False:
return 'false'
return str(value)
def mk_elem(parent, tag=None, text=None, empty=False, **kwargs):
"""Add element as a child of parent."""
# special-case the top-level element
if tag is None:
tag = parent
parent = None
empty = True
# don't create empty elements
if not empty and text is None and \
all(x is None for x in kwargs.values()):
return
# replace namespace identifier with URL
if ':' in tag:
ns, name = tag.split(':', 1)
tag = '{%s}%s' % (namespaces[ns], name)
if parent is None:
element = etree.Element(tag)
else:
element = etree.SubElement(parent, tag)
# set text of element
if text is not None:
element.text = _format(text)
# set kwargs as attributes
for k, v in kwargs.items():
if v is not None:
element.set(k, _format(v))
return element
def tostring(element):
"""Return a serialised XML document for the element tree."""
from xml.dom import minidom
# if we are using lxml.etree move namespaces to toplevel element
if hasattr(element, 'nsmap'): # pragma: no cover (only on lxml)
# get all used namespaces
nsmap = {}
for e in element.iter():
nsmap.update(e.nsmap)
# replace toplevel element with all namespaces
e = etree.Element(element.tag, attrib=element.attrib, nsmap=nsmap)
for a in element:
e.append(a)
element = e
xml = etree.tostring(element, encoding='UTF-8')
return minidom.parseString(xml).toprettyxml(
indent=' ', encoding='UTF-8').strip()
python-pskc-0.5/pskc/algorithms.py 0000644 0000000 0000000 00000006400 12706440470 017262 0 ustar root root 0000000 0000000 # algorithms.py - module for handling algorithm URIs
# coding: utf-8
#
# Copyright (C) 2016 Arthur de Jong
#
# This library is free software; you can redistribute it and/or
# modify it under the terms of the GNU Lesser General Public
# License as published by the Free Software Foundation; either
# version 2.1 of the License, or (at your option) any later version.
#
# This library is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
# Lesser General Public License for more details.
#
# You should have received a copy of the GNU Lesser General Public
# License along with this library; if not, write to the Free Software
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
# 02110-1301 USA
"""Utility module that handles algorthm URIs."""
# cannonical URIs of known algorithms
_algorithms = {
'tripledes-cbc': 'http://www.w3.org/2001/04/xmlenc#tripledes-cbc',
'kw-tripledes': 'http://www.w3.org/2001/04/xmlenc#kw-tripledes',
'aes128-cbc': 'http://www.w3.org/2001/04/xmlenc#aes128-cbc',
'aes192-cbc': 'http://www.w3.org/2001/04/xmlenc#aes192-cbc',
'aes256-cbc': 'http://www.w3.org/2001/04/xmlenc#aes256-cbc',
'kw-aes128': 'http://www.w3.org/2001/04/xmlenc#kw-aes128',
'kw-aes192': 'http://www.w3.org/2001/04/xmlenc#kw-aes192',
'kw-aes256': 'http://www.w3.org/2001/04/xmlenc#kw-aes256',
'camellia128': 'http://www.w3.org/2001/04/xmldsig-more#camellia128',
'camellia192': 'http://www.w3.org/2001/04/xmldsig-more#camellia192',
'camellia256': 'http://www.w3.org/2001/04/xmldsig-more#camellia256',
'kw-camellia128': 'http://www.w3.org/2001/04/xmldsig-more#kw-camellia128',
'kw-camellia192': 'http://www.w3.org/2001/04/xmldsig-more#kw-camellia192',
'kw-camellia256': 'http://www.w3.org/2001/04/xmldsig-more#kw-camellia256',
'hmac-md5': 'http://www.w3.org/2001/04/xmldsig-more#hmac-md5',
'hmac-sha1': 'http://www.w3.org/2000/09/xmldsig#hmac-sha1',
'hmac-sha224': 'http://www.w3.org/2001/04/xmldsig-more#hmac-sha224',
'hmac-sha256': 'http://www.w3.org/2001/04/xmldsig-more#hmac-sha256',
'hmac-sha384': 'http://www.w3.org/2001/04/xmldsig-more#hmac-sha384',
'hmac-sha512': 'http://www.w3.org/2001/04/xmldsig-more#hmac-sha512',
'hmac-ripemd160': 'http://www.w3.org/2001/04/xmldsig-more#hmac-ripemd160',
'pbkdf2': 'http://www.rsasecurity.com/rsalabs/pkcs/schemas/' +
'pkcs-5v2-0#pbkdf2',
}
# translation table to change old encryption names to new names
_algorithm_aliases = {
'3des-cbc': 'tripledes-cbc',
'3des112-cbc': 'tripledes-cbc',
'3des168-cbc': 'tripledes-cbc',
'kw-3des': 'kw-tripledes',
'pbe-3des112-cbc': 'tripledes-cbc',
'pbe-3des168-cbc': 'tripledes-cbc',
'pbe-aes128-cbc': 'aes128-cbc',
'pbe-aes192-cbc': 'aes192-cbc',
'pbe-aes256-cbc': 'aes256-cbc',
'rsa-1_5': 'rsa-1_5',
'rsa-oaep-mgf1p': 'rsa-oaep-mgf1p',
}
def normalise_algorithm(algorithm):
"""Return the canonical URI for the provided algorithm."""
if not algorithm or algorithm.lower() == 'none':
return None
algorithm = _algorithm_aliases.get(algorithm.lower(), algorithm)
return _algorithms.get(algorithm.rsplit('#', 1)[-1].lower(), algorithm)
python-pskc-0.5/pskc/serialiser.py 0000644 0000000 0000000 00000024111 13040515160 017241 0 ustar root root 0000000 0000000 # serialiser.py - PSKC file parsing functions
# coding: utf-8
#
# Copyright (C) 2016 Arthur de Jong
#
# This library is free software; you can redistribute it and/or
# modify it under the terms of the GNU Lesser General Public
# License as published by the Free Software Foundation; either
# version 2.1 of the License, or (at your option) any later version.
#
# This library is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
# Lesser General Public License for more details.
#
# You should have received a copy of the GNU Lesser General Public
# License along with this library; if not, write to the Free Software
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
# 02110-1301 USA
"""Module for serialising PSKC files to XML."""
import base64
from pskc.xml import find, mk_elem, tostring
class PSKCSerialiser(object):
@classmethod
def serialise_file(cls, pskc, output):
xml = tostring(cls.serialise_document(pskc)) + '\n'.encode('UTF-8')
try:
output.write(xml)
except TypeError: # pragma: no cover (Python 3 specific)
# fall back to writing as string for Python 3
output.write(xml.decode('utf-8'))
@classmethod
def serialise_document(cls, pskc):
container = mk_elem('pskc:KeyContainer', Version=pskc.version,
Id=pskc.id)
cls.serialise_encryption(pskc.encryption, container)
cls.serialise_mac(pskc.mac, container)
for device in pskc.devices:
cls.serialise_key_package(device, container)
return container
@classmethod
def serialise_encryption(cls, encryption, container):
if all(x is None
for x in (encryption.id, encryption.key_name, encryption.key,
encryption.derivation.algorithm)):
return
encryption_key = mk_elem(container, 'pskc:EncryptionKey',
Id=encryption.id, empty=True)
if encryption.derivation.algorithm:
cls.serialise_key_derivation(
encryption.derivation, encryption_key, encryption.key_names)
else:
for name in encryption.key_names:
mk_elem(encryption_key, 'ds:KeyName', name)
@classmethod
def serialise_key_derivation(cls, derivation, encryption_key, key_names):
derived_key = mk_elem(encryption_key, 'xenc11:DerivedKey', empty=True)
key_derivation = mk_elem(derived_key, 'xenc11:KeyDerivationMethod',
Algorithm=derivation.algorithm)
if derivation.algorithm.endswith('#pbkdf2'):
pbkdf2 = mk_elem(key_derivation, 'xenc11:PBKDF2-params',
empty=True)
if derivation.pbkdf2_salt:
salt = mk_elem(pbkdf2, 'Salt', empty=True)
mk_elem(salt, 'Specified',
base64.b64encode(derivation.pbkdf2_salt))
mk_elem(pbkdf2, 'IterationCount', derivation.pbkdf2_iterations)
mk_elem(pbkdf2, 'KeyLength', derivation.pbkdf2_key_length)
mk_elem(pbkdf2, 'PRF', derivation.pbkdf2_prf)
# TODO: serialise ReferenceList/DataReference
for name in key_names:
mk_elem(derived_key, 'xenc11:MasterKeyName', name)
@classmethod
def serialise_mac(cls, mac, container):
if not mac.algorithm and not mac.key:
return
mac_method = mk_elem(
container, 'pskc:MACMethod', Algorithm=mac.algorithm, empty=True)
mac_key = mk_elem(mac_method, 'pskc:MACKey', empty=True)
mk_elem(
mac_key, 'xenc:EncryptionMethod',
Algorithm=mac.pskc.encryption.algorithm)
cipher_data = mk_elem(mac_key, 'xenc:CipherData', empty=True)
if mac.key_cipher_value:
mk_elem(cipher_data, 'xenc:CipherValue',
base64.b64encode(mac.key_cipher_value).decode())
elif mac.key_plain_value:
mk_elem(cipher_data, 'xenc:CipherValue',
base64.b64encode(mac.pskc.encryption.encrypt_value(
mac.key_plain_value)).decode())
@classmethod
def serialise_key_package(cls, device, container):
key_package = mk_elem(container, 'pskc:KeyPackage', empty=True)
if any(x is not None
for x in (device.manufacturer, device.serial, device.model,
device.issue_no, device.device_binding,
device.start_date, device.expiry_date,
device.device_userid)):
device_info = mk_elem(key_package, 'pskc:DeviceInfo', empty=True)
mk_elem(device_info, 'pskc:Manufacturer', device.manufacturer)
mk_elem(device_info, 'pskc:SerialNo', device.serial)
mk_elem(device_info, 'pskc:Model', device.model)
mk_elem(device_info, 'pskc:IssueNo', device.issue_no)
mk_elem(device_info, 'pskc:DeviceBinding', device.device_binding)
mk_elem(device_info, 'pskc:StartDate', device.start_date)
mk_elem(device_info, 'pskc:ExpiryDate', device.expiry_date)
mk_elem(device_info, 'pskc:UserId', device.device_userid)
if device.crypto_module is not None:
crypto_module = mk_elem(key_package, 'pskc:CryptoModuleInfo',
empty=True)
mk_elem(crypto_module, 'pskc:Id', device.crypto_module)
for key in device.keys:
cls.serialise_key(key, key_package)
@classmethod
def serialise_key(cls, key, key_package):
key_elm = mk_elem(key_package, 'pskc:Key', empty=True, Id=key.id,
Algorithm=key.algorithm, )
mk_elem(key_elm, 'pskc:Issuer', key.issuer)
if any((key.algorithm_suite, key.challenge_encoding,
key.response_encoding, key.response_length)):
parameters = mk_elem(key_elm, 'pskc:AlgorithmParameters',
empty=True)
mk_elem(parameters, 'pskc:Suite', key.algorithm_suite)
mk_elem(parameters, 'pskc:ChallengeFormat',
Encoding=key.challenge_encoding,
Min=key.challenge_min_length,
Max=key.challenge_max_length,
CheckDigits=key.challenge_check)
mk_elem(parameters, 'pskc:ResponseFormat',
Encoding=key.response_encoding,
Length=key.response_length,
CheckDigits=key.response_check)
mk_elem(key_elm, 'pskc:KeyProfileId', key.key_profile)
mk_elem(key_elm, 'pskc:KeyReference', key.key_reference)
mk_elem(key_elm, 'pskc:FriendlyName', key.friendly_name)
cls.serialise_datatype(
key._secret, key_elm, 'pskc:Secret', 'secret')
cls.serialise_datatype(
key._counter, key_elm, 'pskc:Counter', 'counter')
cls.serialise_datatype(
key._time_offset, key_elm, 'pskc:Time', 'time_offset')
cls.serialise_datatype(
key._time_interval, key_elm, 'pskc:TimeInterval', 'time_interval')
cls.serialise_datatype(
key._time_drift, key_elm, 'pskc:TimeDrift', 'time_drif')
mk_elem(key_elm, 'pskc:UserId', key.key_userid)
cls.serialise_policy(key.policy, key_elm)
@classmethod
def serialise_datatype(cls, dt, key_elm, tag, field):
# skip empty values
if dt.value in (None, '') and not dt.cipher_value:
return
# find the data tag and create our tag under it
data = find(key_elm, 'pskc:Data')
if data is None:
data = mk_elem(key_elm, 'pskc:Data', empty=True)
element = mk_elem(data, tag, empty=True)
# see if we should encrypt
if field in dt.pskc.encryption.fields and not dt.cipher_value:
dt.cipher_value = dt.pskc.encryption.encrypt_value(
dt._to_bin(dt.value))
dt.algorithm = dt.pskc.encryption.algorithm
dt.value = None
# write out value
if dt.cipher_value:
encrypted_value = mk_elem(
element, 'pskc:EncryptedValue', empty=True)
mk_elem(
encrypted_value, 'xenc:EncryptionMethod',
Algorithm=dt.algorithm)
cipher_data = mk_elem(
encrypted_value, 'xenc:CipherData', empty=True)
mk_elem(
cipher_data, 'xenc:CipherValue',
base64.b64encode(dt.cipher_value).decode())
if dt.value_mac:
mk_elem(element, 'pskc:ValueMAC', base64.b64encode(
dt.value_mac).decode())
elif dt.pskc.mac.algorithm:
mk_elem(element, 'pskc:ValueMAC', base64.b64encode(
dt.pskc.mac.generate_mac(dt.cipher_value)
).decode())
else:
mk_elem(element, 'pskc:PlainValue', dt._to_text(dt.value))
@classmethod
def serialise_policy(cls, policy, key_elm):
# check if any policy attribute is set
if not policy.key_usage and all(x is None for x in (
policy.start_date, policy.expiry_date,
policy.number_of_transactions, policy.pin_key_id, policy.pin_usage,
policy.pin_max_failed_attemtps, policy.pin_min_length,
policy.pin_max_length, policy.pin_encoding)):
return
policy_elm = mk_elem(key_elm, 'pskc:Policy', empty=True)
mk_elem(policy_elm, 'pskc:StartDate', policy.start_date)
mk_elem(policy_elm, 'pskc:ExpiryDate', policy.expiry_date)
mk_elem(policy_elm, 'pskc:PINPolicy',
PINKeyId=policy.pin_key_id,
PINUsageMode=policy.pin_usage,
MaxFailedAttempts=policy.pin_max_failed_attemtps,
MinLength=policy.pin_min_length,
MaxLength=policy.pin_max_length,
PINEncoding=policy.pin_encoding)
for usage in policy.key_usage:
mk_elem(policy_elm, 'pskc:KeyUsage', usage)
mk_elem(policy_elm, 'pskc:NumberOfTransactions',
policy.number_of_transactions)
python-pskc-0.5/pskc/mac.py 0000644 0000000 0000000 00000011272 13040703437 015651 0 ustar root root 0000000 0000000 # mac.py - module for checking value signatures
# coding: utf-8
#
# Copyright (C) 2014-2016 Arthur de Jong
#
# This library is free software; you can redistribute it and/or
# modify it under the terms of the GNU Lesser General Public
# License as published by the Free Software Foundation; either
# version 2.1 of the License, or (at your option) any later version.
#
# This library is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
# Lesser General Public License for more details.
#
# You should have received a copy of the GNU Lesser General Public
# License along with this library; if not, write to the Free Software
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
# 02110-1301 USA
"""Module that provides message authentication for PSKC values.
This module provides a MAC class that is used to store information about
how the MAC should be calculated (including the MAC key) and a ValueMAC
class that provides (H)MAC checking for PSKC key data.
The MAC key is generated specifically for each PSKC file and encrypted
with the PSKC encryption key.
"""
import re
_hmac_url_re = re.compile(r'^.*#hmac-(?P[a-z0-9]+)$')
def get_hash(algorithm):
"""Return the hash function for the specifies HMAC algorithm."""
import hashlib
match = _hmac_url_re.search(algorithm)
if match:
return getattr(hashlib, match.group('hash'), None)
def get_hmac(algorithm):
"""Return an HMAC function that takes a secret and a value and returns a
digest."""
import hmac
digestmod = get_hash(algorithm)
if digestmod is not None:
return lambda key, value: hmac.new(key, value, digestmod).digest()
def get_mac(algorithm, key, value):
"""Generate the MAC value over the specified value."""
from pskc.exceptions import DecryptionError
if algorithm is None:
raise DecryptionError('No MAC algorithm set')
hmacfn = get_hmac(algorithm)
if hmacfn is None:
raise DecryptionError(
'Unsupported MAC algorithm: %r' % algorithm)
return hmacfn(key, value)
class MAC(object):
"""Class describing the MAC algorithm to use and how to get the key.
Instances of this class provide the following attributes:
algorithm: the name of the HMAC to use (currently only HMAC_SHA1)
key: the binary value of the MAC key if it can be decrypted
"""
def __init__(self, pskc):
self.pskc = pskc
self._algorithm = None
self.key_plain_value = None
self.key_cipher_value = None
self.key_algorithm = None
@property
def key(self):
"""Provides access to the MAC key binary value if available."""
if self.key_plain_value:
return self.key_plain_value
elif self.key_cipher_value:
return self.pskc.encryption.decrypt_value(
self.key_cipher_value, self.key_algorithm)
# fall back to encryption key
return self.pskc.encryption.key
@key.setter
def key(self, value):
self.key_plain_value = value
self.key_cipher_value = None
@property
def algorithm(self):
"""Provide the MAC algorithm used."""
if self._algorithm:
return self._algorithm
@algorithm.setter
def algorithm(self, value):
from pskc.algorithms import normalise_algorithm
self._algorithm = normalise_algorithm(value)
@property
def algorithm_key_length(self):
"""Recommended minimal key length in bytes for the set algorithm."""
# https://tools.ietf.org/html/rfc2104#section-3
# an HMAC key should be at least as long as the hash output length
hashfn = get_hash(self.algorithm)
if hashfn is not None:
return int(hashfn().digest_size)
else:
return 16
def generate_mac(self, value):
"""Generate the MAC over the specified value."""
return get_mac(self.algorithm, self.key, value)
def setup(self, key=None, algorithm=None):
"""Configure an encrypted MAC key.
The following arguments may be supplied:
key: the MAC key to use
algorithm: MAC algorithm
None of the arguments are required, reasonable defaults will be
chosen for missing arguments.
"""
if key:
self.key = key
if algorithm:
self.algorithm = algorithm
# default to HMAC-SHA1
if not self.algorithm:
self.algorithm = 'hmac-sha1'
# generate an HMAC key
if not self.key:
from Crypto import Random
self.key = Random.get_random_bytes(self.algorithm_key_length)
python-pskc-0.5/pskc/crypto/ 0000755 0000000 0000000 00000000000 13040717606 016057 5 ustar root root 0000000 0000000 python-pskc-0.5/pskc/crypto/aeskw.py 0000644 0000000 0000000 00000010065 12765310161 017543 0 ustar root root 0000000 0000000 # aeskw.py - implementation of AES key wrapping
# coding: utf-8
#
# Copyright (C) 2014-2015 Arthur de Jong
#
# This library is free software; you can redistribute it and/or
# modify it under the terms of the GNU Lesser General Public
# License as published by the Free Software Foundation; either
# version 2.1 of the License, or (at your option) any later version.
#
# This library is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
# Lesser General Public License for more details.
#
# You should have received a copy of the GNU Lesser General Public
# License along with this library; if not, write to the Free Software
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
# 02110-1301 USA
"""Implement key wrapping as described in RFC 3394 and RFC 5649."""
import binascii
from Crypto.Cipher import AES
from Crypto.Util.number import bytes_to_long, long_to_bytes
from Crypto.Util.strxor import strxor
from pskc.exceptions import EncryptionError, DecryptionError
def _split(value):
return value[:8], value[8:]
RFC3394_IV = binascii.a2b_hex('a6a6a6a6a6a6a6a6')
RFC5649_IV = binascii.a2b_hex('a65959a6')
def wrap(plaintext, key, iv=None, pad=None):
"""Apply the AES key wrap algorithm to the plaintext.
The iv can specify an initial value, otherwise the value from RFC 3394 or
RFC 5649 will be used, depending on the plaintext length and the value of
pad.
If pad is True, padding as described in RFC 5649 will always be used. If
pad is False, padding is disabled. Other values automatically enable RFC
5649 padding when needed."""
if iv is not None:
pad = False
mli = len(plaintext)
if pad is False and (mli % 8 != 0 or mli < 16):
raise EncryptionError('Plaintext length wrong')
if mli % 8 != 0 and pad is not False:
r = (mli + 7) // 8
plaintext += ((r * 8) - mli) * b'\0'
if iv is None:
if len(plaintext) != mli or pad is True:
iv = RFC5649_IV + long_to_bytes(mli, 4)
else:
iv = RFC3394_IV
encrypt = AES.new(key).encrypt
n = len(plaintext) // 8
if n == 1:
# RFC 5649 shortcut
return encrypt(iv + plaintext)
A = iv
R = [plaintext[i * 8:i * 8 + 8]
for i in range(n)]
for j in range(6):
for i in range(n):
A, R[i] = _split(encrypt(A + R[i]))
A = strxor(A, long_to_bytes(n * j + i + 1, 8))
return A + b''.join(R)
def unwrap(ciphertext, key, iv=None, pad=None):
"""Apply the AES key unwrap algorithm to the ciphertext.
The iv can specify an initial value, otherwise the value from RFC 3394 or
RFC 5649 will be used, depending on the value of pad.
If pad is False, unpadding as described in RFC 5649 will be disabled,
otherwise checking and removing the padding is automatically done."""
if iv is not None:
pad = False
if len(ciphertext) % 8 != 0 or (pad is False and len(ciphertext) < 24):
raise DecryptionError('Ciphertext length wrong')
decrypt = AES.new(key).decrypt
n = len(ciphertext) // 8 - 1
if n == 1:
A, plaintext = _split(decrypt(ciphertext))
else:
A = ciphertext[:8]
R = [ciphertext[(i + 1) * 8:(i + 2) * 8]
for i in range(n)]
for j in reversed(range(6)):
for i in reversed(range(n)):
A = strxor(A, long_to_bytes(n * j + i + 1, 8))
A, R[i] = _split(decrypt(A + R[i]))
plaintext = b''.join(R)
if iv is None:
if A == RFC3394_IV and pad is not True:
return plaintext
elif A[:4] == RFC5649_IV and pad is not False:
mli = bytes_to_long(A[4:])
# check padding length is valid and plaintext only contains zeros
if 8 * (n - 1) < mli <= 8 * n and \
plaintext.endswith((len(plaintext) - mli) * b'\0'):
return plaintext[:mli]
elif A == iv:
return plaintext
raise DecryptionError('IV does not match')
python-pskc-0.5/pskc/crypto/__init__.py 0000644 0000000 0000000 00000002675 13036777211 020205 0 ustar root root 0000000 0000000 # __init__.py - general crypto utility functions
# coding: utf-8
#
# Copyright (C) 2016 Arthur de Jong
#
# This library is free software; you can redistribute it and/or
# modify it under the terms of the GNU Lesser General Public
# License as published by the Free Software Foundation; either
# version 2.1 of the License, or (at your option) any later version.
#
# This library is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
# Lesser General Public License for more details.
#
# You should have received a copy of the GNU Lesser General Public
# License along with this library; if not, write to the Free Software
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
# 02110-1301 USA
"""Implement crypto utility functions."""
def pad(value, block_size):
"""Pad the value to block_size length."""
padding = block_size - (len(value) % block_size)
return value + padding * chr(padding).encode('ascii')
def unpad(value, block_size):
"""Remove padding from the plaintext."""
from pskc.exceptions import DecryptionError
padding = ord(value[-1:])
# only unpad if all padding bytes are the same
if (padding > 0 and padding <= block_size and
value[-padding:] == padding * chr(padding).encode('ascii')):
return value[:-padding]
raise DecryptionError('Invalid padding')
python-pskc-0.5/pskc/crypto/tripledeskw.py 0000644 0000000 0000000 00000004765 12605044512 020775 0 ustar root root 0000000 0000000 # tripledeskw.py - implementation of Triple DES key wrapping
# coding: utf-8
#
# Copyright (C) 2014-2015 Arthur de Jong
#
# This library is free software; you can redistribute it and/or
# modify it under the terms of the GNU Lesser General Public
# License as published by the Free Software Foundation; either
# version 2.1 of the License, or (at your option) any later version.
#
# This library is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
# Lesser General Public License for more details.
#
# You should have received a copy of the GNU Lesser General Public
# License along with this library; if not, write to the Free Software
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
# 02110-1301 USA
"""Implement Triple DES key wrapping as described in RFC 3217."""
import binascii
from Crypto import Random
from Crypto.Cipher import DES3
from Crypto.Hash import SHA
from pskc.exceptions import EncryptionError, DecryptionError
def _cms_hash(value):
"""The key checksum algorithm described in RFC 3217 section 2."""
return SHA.new(value).digest()[:8]
RFC3217_IV = binascii.a2b_hex('4adda22c79e82105')
def wrap(plaintext, key, iv=None):
"""Wrap one key (typically a Triple DES key) with another Triple DES key.
This uses the algorithm from RFC 3217 to encrypt the plaintext (the key
to wrap) using the provided key. If the iv is None, it is randomly
generated."""
if len(plaintext) % DES3.block_size != 0:
raise EncryptionError('Plaintext length wrong')
if iv is None:
iv = Random.get_random_bytes(8)
cipher = DES3.new(key, DES3.MODE_CBC, iv)
tmp = iv + cipher.encrypt(plaintext + _cms_hash(plaintext))
cipher = DES3.new(key, DES3.MODE_CBC, RFC3217_IV)
return cipher.encrypt(tmp[::-1])
def unwrap(ciphertext, key):
"""Unwrap a key (typically Triple DES key ) with another Triple DES key.
This uses the algorithm from RFC 3217 to decrypt the ciphertext (the
previously wrapped key) using the provided key."""
if len(ciphertext) % DES3.block_size != 0:
raise DecryptionError('Ciphertext length wrong')
cipher = DES3.new(key, DES3.MODE_CBC, RFC3217_IV)
tmp = cipher.decrypt(ciphertext)[::-1]
cipher = DES3.new(key, DES3.MODE_CBC, tmp[:8])
tmp = cipher.decrypt(tmp[8:])
if tmp[-8:] == _cms_hash(tmp[:-8]):
return tmp[:-8]
raise DecryptionError('CMS key checksum error')
python-pskc-0.5/pskc/device.py 0000644 0000000 0000000 00000004630 13036777211 016356 0 ustar root root 0000000 0000000 # device.py - module for handling device info from pskc files
# coding: utf-8
#
# Copyright (C) 2016 Arthur de Jong
#
# This library is free software; you can redistribute it and/or
# modify it under the terms of the GNU Lesser General Public
# License as published by the Free Software Foundation; either
# version 2.1 of the License, or (at your option) any later version.
#
# This library is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
# Lesser General Public License for more details.
#
# You should have received a copy of the GNU Lesser General Public
# License along with this library; if not, write to the Free Software
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
# 02110-1301 USA
"""Module that handles device information stored in PSKC files."""
class Device(object):
"""Representation of a single key from a PSKC file.
Instances of this class provide the following properties:
manufacturer: name of the organisation that made the device
serial: serial number of the device
model: device model description
issue_no: issue number per serial number
device_binding: device (class) identifier for the key to be loaded upon
start_date: key should not be used before this date
expiry_date: key or device may expire after this date
device_userid: user distinguished name associated with the device
crypto_module: id of module to which keys are provisioned within device
"""
def __init__(self, pskc):
self.pskc = pskc
self.manufacturer = None
self.serial = None
self.model = None
self.issue_no = None
self.device_binding = None
self.start_date = None
self.expiry_date = None
self.device_userid = None
self.crypto_module = None
self.keys = []
def add_key(self, **kwargs):
"""Create a new key instance for the device.
The new key is initialised with properties from the provided keyword
arguments if any."""
from pskc.key import Key
key = Key(self)
self.keys.append(key)
# assign the kwargs as key properties
for k, v in kwargs.items():
if not hasattr(key, k):
raise AttributeError()
setattr(key, k, v)
return key
python-pskc-0.5/PKG-INFO 0000644 0000000 0000000 00000005037 13040717606 014701 0 ustar root root 0000000 0000000 Metadata-Version: 1.1
Name: python-pskc
Version: 0.5
Summary: Python module for handling PSKC files
Home-page: http://arthurdejong.org/python-pskc/
Author: Arthur de Jong
Author-email: arthur@arthurdejong.org
License: LGPL
Description: Python module for handling PSKC files
This Python library handles Portable Symmetric Key Container (PSKC) files as
defined in RFC 6030. PSKC files are used to transport and provision symmetric
keys (seed files) to different types of crypto modules, commonly one-time
password tokens or other authentication devices.
This module can be used to extract keys from PSKC files for use in an OTP
authentication system. The module can also be used for authoring PSKC files.
The following prints all keys, decrypting using a password:
>>> from pskc import PSKC
>>> pskc = PSKC('tests/rfc6030/figure7.pskcxml')
>>> pskc.encryption.derive_key('qwerty')
>>> for key in pskc.keys:
... print('%s %s' % (key.serial, str(key.secret.decode())))
987654321 12345678901234567890
The following generates an encrypted PSKC file:
>>> pskc = PSKC()
>>> key = pskc.add_key(
... id='456', secret='987654321', manufacturer='Manufacturer',
... algorithm = 'urn:ietf:params:xml:ns:keyprov:pskc:hotp')
>>> pskc.encryption.setup_pbkdf2('passphrase')
>>> pskc.write('output.pskcxml')
The module should be able to handle most common PSKC files.
Keywords: PSKC,RFC 6030,key container
Platform: UNKNOWN
Classifier: Development Status :: 4 - Beta
Classifier: Intended Audience :: Developers
Classifier: Intended Audience :: Information Technology
Classifier: Intended Audience :: System Administrators
Classifier: License :: OSI Approved :: GNU Lesser General Public License v2 or later (LGPLv2+)
Classifier: Operating System :: OS Independent
Classifier: Programming Language :: Python
Classifier: Programming Language :: Python :: 2
Classifier: Programming Language :: Python :: 2.7
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.4
Classifier: Programming Language :: Python :: 3.5
Classifier: Programming Language :: Python :: 3.6
Classifier: Topic :: Security :: Cryptography
Classifier: Topic :: Software Development :: Libraries :: Python Modules
Classifier: Topic :: System :: Systems Administration :: Authentication/Directory
Classifier: Topic :: Text Processing :: Markup :: XML
python-pskc-0.5/docs/ 0000755 0000000 0000000 00000000000 13040717606 014527 5 ustar root root 0000000 0000000 python-pskc-0.5/docs/encryption.rst 0000644 0000000 0000000 00000012231 12767245644 017467 0 ustar root root 0000000 0000000 PSKC encryption
===============
.. module:: pskc.encryption
Some of the information in PSKC files (e.g. key material) can be encrypted
with either pre-shared keys, passphrase-based keys or asymmetric keys
(asymmetric keys are currently unimplemented).
Embedded PSKC encryption is handled inside the :class:`Encryption` class that
defines encryption key or means of deriving keys. It is accessed from the
:attr:`~pskc.PSKC.encryption` attribute of a :class:`~pskc.PSKC` instance::
>>> from binascii import a2b_hex
>>> from pskc import PSKC
>>> pskc = PSKC('somefile.pskcxml')
>>> pskc.encryption.key = a2b_hex('12345678901234567890123456789012')
or::
>>> pskc.encryption.derive_key('qwerty')
Once the encryption key has been set up, any encrypted key values from the
PSKC file are available transparently.
If no key or an incorrect key has been configured, upon accessing encrypted
information (e.g. the :attr:`~pskc.key.Key.secret` attribute of a
:class:`~pskc.key.Key` instance) a :exc:`~pskc.exceptions.DecryptionError`
exception will be raised.
When writing out a PSKC file, encryption can be configured with the
:func:`~pskc.encryption.Encryption.setup_preshared_key()` or
:func:`~pskc.encryption.Encryption.setup_pbkdf2()` function::
>>> from pskc import PSKC
>>> pskc = PSKC()
>>> pskc.encryption.setup_preshared_key(algorithm='AES256-CBC')
or::
>>> pskc.encryption.setup_pbkdf2(password='verysecure')
The Encryption class
--------------------
.. class:: Encryption
.. attribute:: id
Optional identifier of the encryption key.
.. attribute:: algorithm
A URI of the encryption algorithm used. Setting a value for this
attribute will result in an attempt to use the canonical URI for this
algorithm. For instance setting a `3DES-CBC` value will automatically
be converted to `http://www.w3.org/2001/04/xmlenc#aes128-cbc`.
.. attribute:: key_names
List of names provided for the encryption key.
.. attribute:: key_name
Since usually only one name is defined for a key but the schema allows
for multiple names, this is a shortcut for accessing the first value of
:attr:`key_names`. It will return ``None`` if no name is available.
.. attribute:: key
The binary value of the encryption key. In the case of pre-shared keys
this value should be set before trying to access encrypted information
in the PSKC file.
When using key derivation the secret key is available in this attribute
after calling :func:`derive_key`.
.. function:: derive_key(password)
Derive a key from the supplied password and information in the PSKC
file (generally algorithm, salt, etc.).
This function may raise a :exc:`~pskc.exceptions.KeyDerivationError`
exception if key derivation fails for some reason.
.. attribute:: fields
A list of :class:`~pskc.key.Key` instance field names that will be
encrypted when the PSKC file is written. List values can contain
``secret``, ``counter``, ``time_offset``, ``time_interval`` and
``time_drift``.
.. function:: setup_preshared_key(...)
Configure pre-shared key encryption when writing the file.
:param binary key: the encryption key to use
:param str id: encryption key identifier
:param str algorithm: encryption algorithm
:param int key_length: encryption key length in bytes
:param str key_name: a name for the key
:param list key_names: a number of names for the key
:param list fields: a list of fields to encrypt
This is a utility function to easily set up encryption. Encryption can
also be set up by manually by setting the
:class:`~pskc.encryption.Encryption` properties.
This method will generate a key if required and set the passed values.
By default AES128-CBC encryption will be configured and unless a key is
specified one of the correct length will be generated. If the algorithm
does not provide integrity checks (e.g. CBC-mode algorithms) integrity
checking in the PSKC file will be set up using
:func:`~pskc.mac.MAC.setup()`.
By default only the :attr:`~pskc.key.Key.secret` property will be
encrypted when writing the file.
.. function:: setup_pbkdf2(...)
Configure password-based PSKC encryption when writing the file.
:param str password: the password to use (required)
:param str id: encryption key identifier
:param str algorithm: encryption algorithm
:param int key_length: encryption key length in bytes
:param str key_name: a name for the key
:param list key_names: a number of names for the key
:param list fields: a list of fields to encrypt
:param binary salt: PBKDF2 salt
:param int salt_length: used when generating random salt
:param int iterations: number of PBKDF2 iterations
:param function prf: PBKDF2 pseudorandom function
Defaults for the above parameters are similar to those for
:func:`setup_preshared_key()` but the password parameter is required.
By default 12000 iterations will be used and a random salt with the
length of the to-be-generated encryption key will be used.
python-pskc-0.5/docs/conf.py 0000644 0000000 0000000 00000014216 13040703437 016027 0 ustar root root 0000000 0000000 # -*- coding: utf-8 -*-
#
# python-pksc documentation build configuration file, created by
# sphinx-quickstart
#
# This file is execfile()d with the current directory set to its containing dir.
#
# Note that not all possible configuration values are present in this
# autogenerated file.
#
# All configuration values have a default; values that are commented out
# serve to show the default.
import sys, os
import pskc
# If extensions (or modules to document with autodoc) are in another directory,
# add these directories to sys.path here. If the directory is relative to the
# documentation root, use os.path.abspath to make it absolute, like shown here.
#sys.path.insert(0, os.path.abspath('..'))
# -- General configuration -----------------------------------------------------
# If your documentation needs a minimal Sphinx version, state it here.
#needs_sphinx = '1.0'
# Add any Sphinx extension module names here, as strings. They can be extensions
# coming with Sphinx (named 'sphinx.ext.*') or your custom ones.
extensions = [
'sphinx.ext.autodoc', 'sphinx.ext.doctest', 'sphinx.ext.todo',
'sphinx.ext.coverage', 'sphinx.ext.autosummary'
]
# Add any paths that contain templates here, relative to this directory.
templates_path = ['_templates']
# The suffix of source filenames.
source_suffix = '.rst'
# The encoding of source files.
source_encoding = 'utf-8'
# The master toctree document.
master_doc = 'index'
# General information about the project.
project = u'python-pskc'
copyright = u'2014-2017 Arthur de Jong'
# The version info for the project you're documenting, acts as replacement for
# |version| and |release|, also used in various other places throughout the
# built documents.
#
# The short X.Y version.
version = pskc.__version__
# The full version, including alpha/beta/rc tags.
release = version
# The language for content autogenerated by Sphinx. Refer to documentation
# for a list of supported languages.
#language = None
# There are two options for replacing |today|: either, you set today to some
# non-false value, then it is used:
#today = ''
# Else, today_fmt is used as the format for a strftime call.
#today_fmt = '%B %d, %Y'
# List of patterns, relative to source directory, that match files and
# directories to ignore when looking for source files.
exclude_patterns = ['_*', '.svn', '.git']
# The reST default role (used for this markup: `text`) to use for all documents.
#default_role = None
# If true, '()' will be appended to :func: etc. cross-reference text.
#add_function_parentheses = True
# If true, the current module name will be prepended to all description
# unit titles (such as .. function::).
#add_module_names = True
# If true, sectionauthor and moduleauthor directives will be shown in the
# output. They are ignored by default.
#show_authors = False
# The name of the Pygments (syntax highlighting) style to use.
pygments_style = 'sphinx'
# A list of ignored prefixes for module index sorting.
modindex_common_prefix = ['pskc.', ]
# Automatically generate stub pages for autosummary entries.
autosummary_generate = True
# -- Options for HTML output ---------------------------------------------------
# The theme to use for HTML and HTML Help pages. See the documentation for
# a list of builtin themes.
html_theme = 'default'
# Theme options are theme-specific and customize the look and feel of a theme
# further. For a list of options available for each theme, see the
# documentation.
#html_theme_options = {}
# Add any paths that contain custom themes here, relative to this directory.
#html_theme_path = []
# The name for this set of Sphinx documents. If None, it defaults to
# " v documentation".
#html_title = None
# A shorter title for the navigation bar. Default is the same as html_title.
#html_short_title = None
# The name of an image file (relative to this directory) to place at the top
# of the sidebar.
#html_logo = None
# The name of an image file (within the static path) to use as favicon of the
# docs. This file should be a Windows icon file (.ico) being 16x16 or 32x32
# pixels large.
#html_favicon = None
# Add any paths that contain custom static files (such as style sheets) here,
# relative to this directory. They are copied after the builtin static files,
# so a file named "default.css" will overwrite the builtin "default.css".
#html_static_path = ['_static']
# If not '', a 'Last updated on:' timestamp is inserted at every page bottom,
# using the given strftime format.
html_last_updated_fmt = '%b %d, %Y'
# If true, SmartyPants will be used to convert quotes and dashes to
# typographically correct entities.
#html_use_smartypants = True
# Custom sidebar templates, maps document names to template names.
#html_sidebars = {}
# Additional templates that should be rendered to pages, maps page names to
# template names.
#html_additional_pages = {}
# If false, no module index is generated.
#html_domain_indices = True
# If false, no index is generated.
#html_use_index = True
# If true, the index is split into individual pages for each letter.
#html_split_index = False
# If true, links to the reST sources are added to the pages.
html_show_sourcelink = False
# If true, "Created using Sphinx" is shown in the HTML footer. Default is True.
#html_show_sphinx = True
# If true, "(C) Copyright ..." is shown in the HTML footer. Default is True.
#html_show_copyright = True
# If true, an OpenSearch description file will be output, and all pages will
# contain a tag referring to it. The value of this option must be the
# base URL from which the finished HTML is served.
#html_use_opensearch = ''
# This is the file name suffix for HTML files (e.g. ".xhtml").
#html_file_suffix = None
# Suffix for generated links to HTML files.
#html_link_suffix = ''
# Output file base name for HTML help builder.
htmlhelp_basename = 'python-pskcdoc'
# -- Options for manual page output --------------------------------------------
# One entry per manual page. List of tuples
# (source start file, name, description, authors, manual section).
man_pages = [
('index', 'python-pskc', u'python-pskc Documentation',
[u'Arthur de Jong'], 1)
]
# If true, show URL addresses after external links.
#man_show_urls = False
python-pskc-0.5/docs/policy.rst 0000644 0000000 0000000 00000013042 12706440470 016560 0 ustar root root 0000000 0000000 Key usage policy
================
.. module:: pskc.policy
The PSKC format allows for specifying `key and pin usage policy `__
per key.
Instances of the :class:`Policy` class provide attributes that describe
limits that are placed on key usage and requirements for key PIN protection::
>>> key = pskc.keys[0]
>>> key.policy.may_use(key.policy.KEY_USE_OTP)
True
The Policy class
----------------
.. class:: Policy
.. attribute:: start_date
:class:`datetime.datetime` value that indicates that the key must not
be used before this date.
.. attribute:: expiry_date
:class:`datetime.datetime` value that indicates that the key must not
be used after this date. Systems should not rely upon the device to
enforce key usage date restrictions, as some devices do not have an
internal clock.
.. attribute:: number_of_transactions
The value indicates the maximum number of times a key carried within
the PSKC document may be used by an application after having received
it.
.. attribute:: key_usage
A list of `valid usage scenarios
`__ for the
key that the recipient should check against the intended usage of the
key. Also see :func:`may_use` and :ref:`key-use-constants` below.
.. attribute:: pin_key_id
The unique `id` of the key within the PSKC file that contains the value
of the PIN that protects this key.
.. attribute:: pin_key
Instance of the :class:`~pskc.key.Key` (if any) that contains the value
of the PIN referenced by :attr:`pin_key_id`.
.. attribute:: pin
PIN value referenced by :attr:`pin_key_id` (if any). The value is
transparently decrypted if possible.
.. attribute:: pin_usage
Describe how the PIN is used during the usage of the key. See
:ref:`pin-use-constants` below.
.. attribute:: pin_max_failed_attemtps
The maximum number of times the PIN may be entered wrongly before it
MUST NOT be possible to use the key any more.
.. attribute:: pin_min_length
The minimum length of a PIN that can be set to protect the associated
key.
.. attribute:: pin_max_length
The maximum length of a PIN that can be set to protect this key.
.. attribute:: pin_encoding
The encoding of the PIN which is one of ``DECIMAL``, ``HEXADECIMAL``,
``ALPHANUMERIC``, ``BASE64``, or ``BINARY`` (see
:attr:`~pskc.key.Key.challenge_encoding`).
.. attribute:: unknown_policy_elements
Boolean that is set to ``True`` if the PSKC policy information contains
unknown or unsupported definitions or values. A conforming
implementation must assume that key usage is not permitted if this
value is ``True`` to ensure that the lack of understanding of certain
extensions does not lead to unintended key usage.
.. function:: may_use(usage=None, now=None)
Check whether the key may be used for the provided purpose. The key
:attr:`start_date` and :attr:`expiry_date` are also checked. The `now`
argument can be used to specify another point in time to check against.
.. _key-use-constants:
Key usage constants
-------------------
The :class:`Policy` class provides the following key use constants (see
:attr:`~Policy.key_usage` and :func:`~Policy.may_use`):
.. autoattribute:: Policy.KEY_USE_OTP
Key is used for OTP generation.
.. autoattribute:: Policy.KEY_USE_CR
The key is used for challenge-response purposes.
.. autoattribute:: Policy.KEY_USE_ENCRYPT
The key is used for data encryption purposes.
.. autoattribute:: Policy.KEY_USE_INTEGRITY
The key is used to generate a keyed message digest for data integrity or
authentication purposes.
.. autoattribute:: Policy.KEY_USE_VERIFY
The key is used to verify a keyed message digest for data integrity or
authentication purposes (this is the opposite of
:attr:`KEY_USE_INTEGRITY`).
.. autoattribute:: Policy.KEY_USE_UNLOCK
The key is used for an inverse challenge-response in the case where a
user has locked the device by entering a wrong PIN too many times (for
devices with PIN-input capability).
.. autoattribute:: Policy.KEY_USE_DECRYPT
The key is used for data decryption purposes.
.. autoattribute:: Policy.KEY_USE_KEYWRAP
The key is used for key wrap purposes.
.. autoattribute:: Policy.KEY_USE_UNWRAP
The key is used for key unwrap purposes.
.. autoattribute:: Policy.KEY_USE_DERIVE
The key is used with a key derivation function to derive a new key.
.. autoattribute:: Policy.KEY_USE_GENERATE
The key is used to generate a new key based on a random number and the
previous value of the key.
.. _pin-use-constants:
Pin usage constants
-------------------
The following constants for PIN use are defined in the :class:`Policy`
class (see :attr:`~Policy.pin_usage`):
.. autoattribute:: Policy.PIN_USE_LOCAL
The PIN is checked locally on the device before allowing the key to be
used in executing the algorithm.
.. autoattribute:: Policy.PIN_USE_PREPEND
The PIN is prepended to the algorithm response. It must be checked by
the party validating the response.
.. autoattribute:: Policy.PIN_USE_APPEND
The PIN is appended to the algorithm response. It must be checked by
the party validating the response.
.. autoattribute:: Policy.PIN_USE_ALGORITHMIC
The PIN is used as part of the algorithm computation.
python-pskc-0.5/docs/_templates/ 0000755 0000000 0000000 00000000000 13040717606 016664 5 ustar root root 0000000 0000000 python-pskc-0.5/docs/_templates/autosummary/ 0000755 0000000 0000000 00000000000 13040717606 021252 5 ustar root root 0000000 0000000 python-pskc-0.5/docs/_templates/autosummary/module.rst 0000644 0000000 0000000 00000000114 12337607021 023262 0 ustar root root 0000000 0000000 {{ fullname }}
{{ underline }}
.. automodule:: {{ fullname }}
:members:
python-pskc-0.5/docs/index.rst 0000644 0000000 0000000 00000000422 12353625504 016367 0 ustar root root 0000000 0000000 .. include:: ../README
:end-before: API
Contents
--------
.. toctree::
:maxdepth: 1
usage
encryption
mac
policy
exceptions
changes
Security considerations
-----------------------
.. include:: ../README
:start-after: -----------------------
python-pskc-0.5/docs/mac.rst 0000644 0000000 0000000 00000003126 12676006201 016017 0 ustar root root 0000000 0000000 Integrity checking
==================
.. module:: pskc.mac
The PSKC format allows for `message authentication and integrity checking
`_ for some of the values
stored within the PSKC file.
Integrity checking is done transparently when accessing attributes that
are encrypted and contain a ValueMAC.
Once the PSKC encryption key has been set up, key values can be explicitly
checked using the :func:`~pskc.key.Key.check` method::
>>> pskc = PSKC('somefile.pskcxml')
>>> pskc.encryption.derive_key('qwerty')
>>> pskc.mac.algorithm
'http://www.w3.org/2000/09/xmldsig#hmac-sha1'
>>> all(key.check() for key in pskc.keys)
True
The MAC class
-------------
.. class:: MAC
.. attribute:: algorithm
The name of the MAC algorithm to use (currently ``HMAC-MD5``,
``HMAC-SHA1``, ``HMAC-SHA224``, ``HMAC-SHA256``, ``HMAC-SHA384`` and
``HMAC-SHA512`` are supported).
.. attribute:: key
For HMAC checking, this contains the binary value of the MAC key. The
MAC key is generated specifically for each PSKC file and encrypted with
the PSKC encryption key, so the PSKC file should be decrypted first
(see :doc:`encryption`).
.. function:: setup(...)
Configure an encrypted MAC key.
:param str algorithm: encryption algorithm
:param binary key: the encryption key to use
None of the arguments are required. By default HMAC-SHA1 will be used
as a MAC algorithm. If no key is configured a random key will be
generated with the length of the output of the configured hash.
python-pskc-0.5/docs/exceptions.rst 0000644 0000000 0000000 00000002454 12605450042 017441 0 ustar root root 0000000 0000000 Exceptions
==========
.. module:: pskc.exceptions
.. exception:: PSKCError
The base class for all exceptions that the module will raise. In some
cases third-party code may raise additional exceptions.
.. exception:: ParseError
Raised when the PSKC file cannot be correctly read due to invalid XML or
some required element or attribute is missing. This exception should only
be raised when parsing the file (i.e. when the :class:`~pskc.PSKC` class is
instantiated).
.. .. exception:: EncryptionError
Raised when encrypting a value is not possible due to key length issues,
missing or wrong length plain text, or other issues.
.. exception:: DecryptionError
Raised when decrypting a value fails due to missing or incorrect key,
unsupported decryption or MAC algorithm, failed message authentication
check or other error.
This exception is generally raised when accessing encrypted information
(i.e. the :attr:`~pskc.key.Key.secret`, :attr:`~pskc.key.Key.counter`,
:attr:`~pskc.key.Key.time_offset`, :attr:`~pskc.key.Key.time_interval` or
:attr:`~pskc.key.Key.time_drift` attributes of the :class:`~pskc.key.Key`
class).
.. exception:: KeyDerivationError
Raised when key derivation fails due to an unsupported algorithm or
missing information in the PSKC file.
python-pskc-0.5/docs/usage.rst 0000644 0000000 0000000 00000033512 13036777211 016374 0 ustar root root 0000000 0000000 Basic usage
===========
The :mod:`pskc` module implements a simple and efficient API for parsing and
creating PSKC files. The :class:`~pskc.PSKC` class is used to access the file
as a whole which provides access to a list of :class:`~pskc.device.Device`
and :class:`~pskc.key.Key` instances which contain most of the useful
information of the PSKC file.
Reading a PSKC file
-------------------
Importing data from a PSKC file can be done by instantiating the
:class:`~pskc.PSKC` class with a file name argument::
>>> from pskc import PSKC
>>> pskc = PSKC('somefile.pskcxml')
>>> pskc.version
'1.0'
The :attr:`~pskc.PSKC.keys` attribute contains a list of keys in the PSKC
file. :class:`~pskc.key.Key` instances have a number of attributes that
provide information on the transmitted keys::
>>> key = pskc.keys[0]
>>> key.id
'some-id'
>>> key.algorithm
'urn:ietf:params:xml:ns:keyprov:pskc:hotp'
>>> key.secret
'SOME_SECRET_VALUE'
Attribute values will be ``None`` if it the value is not present in the PSKC
file.
The :attr:`~pskc.key.Key.secret`, :attr:`~pskc.key.Key.counter`,
:attr:`~pskc.key.Key.time_offset`, :attr:`~pskc.key.Key.time_interval` or
:attr:`~pskc.key.Key.time_drift` attributes may be stored in encrypted form
in the PSKC file. Decryption of these properties is done when they are
accessed. If decryption is unsuccessful a
:exc:`~pskc.exceptions.DecryptionError` exception is raised. See
:doc:`encryption` for more information.
Writing a PSKC file
-------------------
Creating a PSKC file can be done by creating a :class:`~pskc.PSKC` instance,
adding keys with :func:`~pskc.PSKC.add_key()` and writing the result::
>>> from pskc import PSKC
>>> pskc = PSKC()
>>> key = pskc.add_key(
... id='456', secret='987654321', manufacturer='Manufacturer',
... algorithm = 'urn:ietf:params:xml:ns:keyprov:pskc:hotp')
>>> pskc.write('output.pskcxml')
By default an unencrypted PSKC file will be created but an encryption can be
configured using the
:func:`~pskc.encryption.Encryption.setup_preshared_key()` or
:func:`~pskc.encryption.Encryption.setup_pbkdf2()` function.
The PSKC class
--------------
.. module:: pskc
.. class:: PSKC([filename])
The :class:`PSKC` class is used as a wrapper to access information from a
PSKC file.
The `filename` argument can be either the name of a file or a file-like
object. The whole file is parsed in one go. If parsing the PSKC file
fails, a :exc:`~pskc.exceptions.ParseError` exception is raised.
If no argument is provided, an instance without any keys is created.
Instances of this class provide the following attributes and functions:
.. attribute:: version
The PSKC format version used. Only version ``1.0`` is currently
specified in
`RFC 6030 `__
and supported.
.. attribute:: id
A unique identifier for the container.
.. attribute:: devices
A list of :class:`~pskc.device.Device` instances that represent the key
containers within the PSKC file.
.. attribute:: keys
A list of :class:`~pskc.key.Key` instances that represent the keys
within the PSKC file.
.. attribute:: encryption
:class:`~pskc.encryption.Encryption` instance that handles PSKC file
encryption. See :doc:`encryption` for more information.
.. attribute:: mac
:class:`~pskc.mac.MAC` instance for handling integrity checking.
See :doc:`mac` for more information.
.. function:: add_device([**kwargs])
Add a new key package to the PSKC instance. The keyword arguments may
refer to any attributes of the :class:`~pskc.device.Device` class with
which the new device is initialised.
.. function:: add_key([**kwargs])
Add a new key to the PSKC instance. The keyword arguments may refer to
any attributes of the :class:`~pskc.key.Key` or
:class:`~pskc.device.Device` class with which the new key is
initialised.
.. function:: write(filename)
Write the PSKC object to the provided file. The `filename` argument can
be either the name of a file or a file-like object.
The Key class
-------------
.. module:: pskc.key
.. class:: Key()
Instances of this class provide the following attributes and functions:
.. attribute:: id
A unique identifier for the key. If there are multiple interactions
with the same key in multiple instances of PSKC files the `id` is
supposed to remain the same.
.. attribute:: algorithm
A URI that identifies the PSKC algorithm profile. The algorithm profile
associates specific semantics to the key. Some `known profiles
`__ are:
+------------------------------------------------+-----------------------------------------------------------------------------------------------------------------------------+
| URI | Purpose |
+================================================+=============================================================================================================================+
| ``urn:ietf:params:xml:ns:keyprov:pskc:pin`` | `Symmetric static credential comparison `_ |
+------------------------------------------------+-----------------------------------------------------------------------------------------------------------------------------+
| ``urn:ietf:params:xml:ns:keyprov:pskc:hotp`` | `OATH event-based OTP `_ |
+------------------------------------------------+-----------------------------------------------------------------------------------------------------------------------------+
| ``urn:ietf:params:xml:ns:keyprov:pskc#totp`` | `OATH time-based OTP `_ |
| ``urn:ietf:params:xml:ns:keyprov:pskc:totp`` | |
+------------------------------------------------+-----------------------------------------------------------------------------------------------------------------------------+
| ``urn:ietf:params:xml:ns:keyprov:pskc#OCRA-1`` | `OATH challenge-response algorithm `_ |
+------------------------------------------------+-----------------------------------------------------------------------------------------------------------------------------+
.. attribute:: secret
The binary value of the transported secret key. If the key information
is encrypted in the PSKC file it is transparently decrypted if
possible. Accessing the value may raise
:exc:`~pskc.exceptions.DecryptionError` if decryption fails.
.. attribute:: counter
The event counter (integer) for event-based OTP algorithms. Will also be
transparently decrypted and may also raise
:exc:`~pskc.exceptions.DecryptionError`.
.. attribute:: time_offset
The time offset (integer) for time-based OTP algorithms. If time
intervals are used it carries the number of time intervals passed from
an algorithm-dependent start point. Will also be transparently decrypted
and may also raise :exc:`~pskc.exceptions.DecryptionError`.
.. attribute:: time_interval
The time interval in seconds (integer) for time-based OTP algorithms
(usually ``30`` or ``60``). Will also be transparently decrypted and may
also raise :exc:`~pskc.exceptions.DecryptionError`.
.. attribute:: time_drift
For time-based OTP algorithms this contains the device clock drift in
number of intervals (integer). Will also be transparently decrypted and
may also raise :exc:`~pskc.exceptions.DecryptionError`.
.. attribute:: issuer
The name of the party that issued the key. This may be different from
the :attr:`~pskc.device.Device.manufacturer` of the device.
.. attribute:: key_profile
A reference to a pre-shared key profile agreed upon between the sending
and receiving parties. The profile information itself is not
transmitted within the container.
See `RFC 6030 `__.
.. attribute:: key_reference
A reference to an external key that is not contained within the PSKC
file (e.g., a PKCS #11 key label). If this attribute is present, the
:attr:`secret` attribute will generally be missing.
.. attribute:: friendly_name
A human-readable name for the secret key.
.. attribute:: key_userid
The distinguished name of the user associated with the key.
Also see :attr:`~pskc.device.Device.device_userid`.
.. attribute:: algorithm_suite
Additional algorithm-specific characteristics. For example, in an
HMAC-based algorithm it could specify the hash algorithm used (SHA1
or SHA256).
.. attribute:: challenge_encoding
Encoding of the challenge accepted by the device for challenge-response
authentication. One of:
* ``DECIMAL``: only numerical digits
* ``HEXADECIMAL``: hexadecimal
* ``ALPHANUMERIC``: all letters and numbers (case sensitive)
* ``BASE64``: base-64 encoded
* ``BINARY``: binary data
.. attribute:: challenge_min_length
The minimum size of the challenge accepted by the device.
.. attribute:: challenge_max_length
The maximum size of the challenge accepted by the device.
.. attribute:: challenge_check
Boolean that indicates whether the device will check an embedded
`Luhn check digit `_
contained in the challenge.
.. attribute:: response_encoding
Format of the response that is generated by the device. If must be one
of the values as described under :attr:`challenge_encoding`.
.. attribute:: response_length
The length of the response generated by the device.
.. attribute:: response_check
Boolean that indicates whether the device will append a
`Luhn check digit `_
to the response.
.. attribute:: policy
:class:`~pskc.policy.Policy` instance that provides key and PIN policy
information. See :doc:`policy`.
.. function:: check()
Check if any MACs in the key data embedded in the PSKC file are valid.
This will return None if there is no MAC to be checked. It will return
True if all the MACs match. If any MAC fails a
:exc:`~pskc.exceptions.DecryptionError` exception is raised.
Apart from the above, all properties of the :class:`~pskc.device.Device`
class are also transparently available in :class:`~pskc.key.Key`
instances.
The Device class
----------------
.. module:: pskc.device
.. class:: Device()
Instances of this class provide the following attributes and functions:
.. attribute:: keys
A list of :class:`~pskc.key.Key` instances that represent the keys that
are linked to this device. Most PSKC files only allow one key per
device which is why all :class:`~pskc.device.Device` attributes are
available in :class:`~pskc.key.Key`.
.. function:: add_key([**kwargs])
Add a new key to the device. The keyword arguments may refer to
any attributes of the :class:`~pskc.key.Key` or
:class:`~pskc.device.Device` class with which the new key is
initialised.
.. attribute:: manufacturer
The name of the manufacturer of the device to which the key is
provisioned.
`RFC 6030 `__
prescribes that the value is of the form ``oath.prefix`` for `OATH
Manufacturer Prefixes `_
or ``iana.organisation`` for `IANA Private Enterprise Numbers
`_
however, it is generally just a string.
The value may be different from the :attr:`~pskc.key.Key.issuer` of
the key on the device.
.. attribute:: serial
The serial number of the device to which the key is provisioned.
Together with :attr:`manufacturer` (and possibly :attr:`issue_no`) this
should uniquely identify the device.
.. attribute:: model
A manufacturer-specific description of the model of the device.
.. attribute:: issue_no
The issue number in case there are devices with the same :attr:`serial`
number so that they can be distinguished by different issue numbers.
.. attribute:: device_binding
Reference to a device identifier (e.g. IMEI) that allows a provisioning
server to ensure that the key is going to be loaded into a specific
device.
.. attribute:: start_date
:class:`datetime.datetime` value that indicates that the device should
only be used after this date.
.. attribute:: expiry_date
:class:`datetime.datetime` value that indicates that the device should
only be used before this date. Systems should not rely upon the device
to enforce key usage date restrictions, as some devices do not have an
internal clock.
.. attribute:: device_userid
The distinguished name of the user associated with the device.
Also see :attr:`~pskc.key.Key.key_userid`.
.. attribute:: crypto_module
Implementation specific unique identifier of the cryptographic module
on the device to which the keys have been (or will be) provisioned.
python-pskc-0.5/docs/changes.rst 0000644 0000000 0000000 00000000104 12353625504 016665 0 ustar root root 0000000 0000000 Changes in python-pskc
======================
.. include:: ../NEWS
python-pskc-0.5/pskc2csv.py 0000755 0000000 0000000 00000011607 13040703437 015714 0 ustar root root 0000000 0000000 #!/usr/bin/env python
# coding: utf-8
# pskc2csv.py - script to convert a PSKC file to CSV
#
# Copyright (C) 2014-2017 Arthur de Jong
#
# This library is free software; you can redistribute it and/or
# modify it under the terms of the GNU Lesser General Public
# License as published by the Free Software Foundation; either
# version 2.1 of the License, or (at your option) any later version.
#
# This library is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
# Lesser General Public License for more details.
#
# You should have received a copy of the GNU Lesser General Public
# License along with this library; if not, write to the Free Software
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
# 02110-1301 USA
from __future__ import print_function
import argparse
import csv
import getpass
import operator
import os.path
import sys
from binascii import a2b_hex, b2a_hex
import pskc
from pskc.exceptions import DecryptionError
version_string = '''
pskc2csv (python-pskc) %s
Written by Arthur de Jong.
Copyright (C) 2014-2017 Arthur de Jong
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
'''.strip() % pskc.__version__
class VersionAction(argparse.Action):
def __init__(self, option_strings, dest,
help='output version information and exit'):
super(VersionAction, self).__init__(
option_strings=option_strings,
dest=argparse.SUPPRESS,
default=argparse.SUPPRESS,
nargs=0,
help=help)
def __call__(self, parser, namespace, values, option_string=None):
print(version_string)
parser.exit()
epilog = '''
supported columns:
id, serial, secret, counter, time_offset, time_interval, interval,
time_drift, issuer, manufacturer, response_length, algorithm
And any other properties of pskc.key.Key instances.
Report bugs to .
'''.strip()
# set up command line parser
parser = argparse.ArgumentParser(
formatter_class=argparse.RawDescriptionHelpFormatter,
description='Convert a PSKC file to CSV.', epilog=epilog)
parser.add_argument(
'input', metavar='FILE', help='the PSKC file to read')
parser.add_argument(
'-V', '--version', action=VersionAction)
parser.add_argument(
'-o', '--output', metavar='FILE',
help='write CSV to file instead of stdout')
parser.add_argument(
'-c', '--columns', metavar='COL,COL', type=lambda x: x.split(','),
help='list of columns to export',
default='serial,secret,algorithm,response_length,time_interval')
parser.add_argument(
'-p', '--password', '--passwd', metavar='PASS/FILE',
help='password to use for decryption (or read from a file)')
parser.add_argument(
'-s', '--secret', metavar='KEY/FILE',
help='hex encoded encryption key or file containing the binary key')
# Python 3 compatible version of b2a_hex
def decode(f):
return lambda x: str(f(x).decode())
b2a_hex = decode(b2a_hex)
def get_column(key, column):
"""Return a string value for the given column."""
value = operator.attrgetter(column)(key)
if column == 'secret':
return b2a_hex(value)
return value
def is_encrypted(pskcfile):
"""Check whether the PSKC file is encrypted."""
try:
pskcfile.keys[0].secret
except DecryptionError:
return True
except IndexError:
pass
return False
if __name__ == '__main__':
# parse command-line arguments
args = parser.parse_args()
# open and parse input PSKC file
pskcfile = pskc.PSKC(args.input)
if args.secret:
if os.path.isfile(args.secret):
with open(args.secret, 'rb') as keyfile:
pskcfile.encryption.key = keyfile.read()
else:
pskcfile.encryption.key = a2b_hex(args.secret)
elif args.password:
if os.path.isfile(args.password):
with open(args.password, 'r') as passfile:
passwd = passfile.read().replace('\n', '')
pskcfile.encryption.derive_key(passwd)
else:
pskcfile.encryption.derive_key(args.password)
elif sys.stdin.isatty() and is_encrypted(pskcfile):
# prompt for a password
prompt = 'Password: '
if pskcfile.encryption.key_name:
prompt = '%s: ' % pskcfile.encryption.key_name
passwd = getpass.getpass(prompt)
pskcfile.encryption.derive_key(passwd)
# open output CSV file, write header and keys
with open(args.output, 'wb') if args.output else sys.stdout as output:
csvfile = csv.writer(output, quoting=csv.QUOTE_MINIMAL)
csvfile.writerow(args.columns)
for key in pskcfile.keys:
csvfile.writerow([
get_column(key, column) for column in args.columns])
python-pskc-0.5/python_pskc.egg-info/ 0000755 0000000 0000000 00000000000 13040717606 017632 5 ustar root root 0000000 0000000 python-pskc-0.5/python_pskc.egg-info/top_level.txt 0000644 0000000 0000000 00000000005 13040717606 022357 0 ustar root root 0000000 0000000 pskc
python-pskc-0.5/python_pskc.egg-info/PKG-INFO 0000644 0000000 0000000 00000005037 13040717606 020734 0 ustar root root 0000000 0000000 Metadata-Version: 1.1
Name: python-pskc
Version: 0.5
Summary: Python module for handling PSKC files
Home-page: http://arthurdejong.org/python-pskc/
Author: Arthur de Jong
Author-email: arthur@arthurdejong.org
License: LGPL
Description: Python module for handling PSKC files
This Python library handles Portable Symmetric Key Container (PSKC) files as
defined in RFC 6030. PSKC files are used to transport and provision symmetric
keys (seed files) to different types of crypto modules, commonly one-time
password tokens or other authentication devices.
This module can be used to extract keys from PSKC files for use in an OTP
authentication system. The module can also be used for authoring PSKC files.
The following prints all keys, decrypting using a password:
>>> from pskc import PSKC
>>> pskc = PSKC('tests/rfc6030/figure7.pskcxml')
>>> pskc.encryption.derive_key('qwerty')
>>> for key in pskc.keys:
... print('%s %s' % (key.serial, str(key.secret.decode())))
987654321 12345678901234567890
The following generates an encrypted PSKC file:
>>> pskc = PSKC()
>>> key = pskc.add_key(
... id='456', secret='987654321', manufacturer='Manufacturer',
... algorithm = 'urn:ietf:params:xml:ns:keyprov:pskc:hotp')
>>> pskc.encryption.setup_pbkdf2('passphrase')
>>> pskc.write('output.pskcxml')
The module should be able to handle most common PSKC files.
Keywords: PSKC,RFC 6030,key container
Platform: UNKNOWN
Classifier: Development Status :: 4 - Beta
Classifier: Intended Audience :: Developers
Classifier: Intended Audience :: Information Technology
Classifier: Intended Audience :: System Administrators
Classifier: License :: OSI Approved :: GNU Lesser General Public License v2 or later (LGPLv2+)
Classifier: Operating System :: OS Independent
Classifier: Programming Language :: Python
Classifier: Programming Language :: Python :: 2
Classifier: Programming Language :: Python :: 2.7
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.4
Classifier: Programming Language :: Python :: 3.5
Classifier: Programming Language :: Python :: 3.6
Classifier: Topic :: Security :: Cryptography
Classifier: Topic :: Software Development :: Libraries :: Python Modules
Classifier: Topic :: System :: Systems Administration :: Authentication/Directory
Classifier: Topic :: Text Processing :: Markup :: XML
python-pskc-0.5/python_pskc.egg-info/SOURCES.txt 0000644 0000000 0000000 00000006270 13040717606 021523 0 ustar root root 0000000 0000000 COPYING
ChangeLog
MANIFEST.in
NEWS
README
pskc2csv.py
setup.cfg
setup.py
docs/changes.rst
docs/conf.py
docs/encryption.rst
docs/exceptions.rst
docs/index.rst
docs/mac.rst
docs/policy.rst
docs/usage.rst
docs/_templates/autosummary/module.rst
pskc/__init__.py
pskc/algorithms.py
pskc/device.py
pskc/encryption.py
pskc/exceptions.py
pskc/key.py
pskc/mac.py
pskc/parser.py
pskc/policy.py
pskc/serialiser.py
pskc/xml.py
pskc/crypto/__init__.py
pskc/crypto/aeskw.py
pskc/crypto/tripledeskw.py
python_pskc.egg-info/PKG-INFO
python_pskc.egg-info/SOURCES.txt
python_pskc.egg-info/dependency_links.txt
python_pskc.egg-info/requires.txt
python_pskc.egg-info/top_level.txt
tests/test_actividentity.doctest
tests/test_aeskw.doctest
tests/test_crypto.doctest
tests/test_draft_ietf_keyprov_pskc_02.doctest
tests/test_draft_keyprov.doctest
tests/test_encryption.doctest
tests/test_feitian.doctest
tests/test_invalid.doctest
tests/test_misc.doctest
tests/test_nagraid.doctest
tests/test_rfc6030.doctest
tests/test_tripledeskw.doctest
tests/test_write.doctest
tests/test_yubico.doctest
tests/draft-hoyer-keyprov-pskc-algorithm-profiles-01/actividentity-3des.pskcxml
tests/draft-hoyer-keyprov-pskc-algorithm-profiles-01/ocra.pskcxml
tests/draft-hoyer-keyprov-pskc-algorithm-profiles-01/securid-aes-counter.pskcxml
tests/draft-hoyer-keyprov-pskc-algorithm-profiles-01/totp.pskcxml
tests/draft-ietf-keyprov-pskc-02/figure2.pskcxml
tests/draft-ietf-keyprov-pskc-02/figure3.pskcxml
tests/draft-ietf-keyprov-pskc-02/figure4.pskcxml
tests/draft-ietf-keyprov-pskc-02/figure5.pskcxml
tests/draft-ietf-keyprov-pskc-02/figure6.pskcxml
tests/draft-ietf-keyprov-pskc-02/figure7.pskcxml
tests/draft-ietf-keyprov-pskc-02/figure8.pskcxml
tests/draft-ietf-keyprov-pskc-02/figure9.pskcxml
tests/encryption/aes128-cbc-noiv.pskcxml
tests/encryption/aes128-cbc.pskcxml
tests/encryption/aes192-cbc.pskcxml
tests/encryption/aes256-cbc.pskcxml
tests/encryption/kw-aes128.pskcxml
tests/encryption/kw-aes192.pskcxml
tests/encryption/kw-aes256.pskcxml
tests/encryption/kw-tripledes.pskcxml
tests/encryption/mac-over-plaintext.pskcxml
tests/encryption/no-mac-key.pskcxml
tests/encryption/tripledes-cbc.pskcxml
tests/feitian/20120919-test001-4282.xml
tests/feitian/file1.pskcxml
tests/invalid/incomplete-derivation.pskcxml
tests/invalid/mac-algorithm.pskcxml
tests/invalid/mac-value.pskcxml
tests/invalid/missing-encryption-method.pskcxml
tests/invalid/missing-encryption.pskcxml
tests/invalid/no-mac-method.pskcxml
tests/invalid/not-boolean.pskcxml
tests/invalid/not-integer.pskcxml
tests/invalid/not-integer2.pskcxml
tests/invalid/notxml.pskcxml
tests/invalid/unknown-encryption.pskcxml
tests/invalid/wrongelement.pskcxml
tests/invalid/wrongversion.pskcxml
tests/misc/SampleFullyQualifiedNS.xml
tests/misc/checkdigits.pskcxml
tests/misc/integers.pskcxml
tests/misc/odd-namespace.pskcxml
tests/misc/policy.pskcxml
tests/nagraid/file1.pskcxml
tests/rfc6030/figure10.pskcxml
tests/rfc6030/figure2.pskcxml
tests/rfc6030/figure3.pskcxml
tests/rfc6030/figure4.pskcxml
tests/rfc6030/figure5.pskcxml
tests/rfc6030/figure6.pskcxml
tests/rfc6030/figure7.pskcxml
tests/rfc6030/figure8.pskcxml
tests/rfc6030/figure9.pskcxml
tests/yubico/example1.pskcxml
tests/yubico/example2.pskcxml
tests/yubico/example3.pskcxml python-pskc-0.5/python_pskc.egg-info/requires.txt 0000644 0000000 0000000 00000000031 13040717606 022224 0 ustar root root 0000000 0000000 pycrypto
python-dateutil
python-pskc-0.5/python_pskc.egg-info/dependency_links.txt 0000644 0000000 0000000 00000000001 13040717606 023700 0 ustar root root 0000000 0000000
python-pskc-0.5/setup.cfg 0000644 0000000 0000000 00000000600 13040717606 015414 0 ustar root root 0000000 0000000 [sdist]
owner = root
group = root
[nosetests]
with-doctest = true
doctest-extension = doctest
doctest-options = +IGNORE_EXCEPTION_DETAIL
with-coverage = true
cover-branches = true
cover-package = pskc
cover-inclusive = true
cover-erase = true
cover-html = true
cover-html-dir = coverage
cover-min-percentage = 100
[build_sphinx]
all_files = 1
[egg_info]
tag_build =
tag_date = 0
python-pskc-0.5/COPYING 0000644 0000000 0000000 00000063504 12323560741 014641 0 ustar root root 0000000 0000000 GNU LESSER GENERAL PUBLIC LICENSE
Version 2.1, February 1999
Copyright (C) 1991, 1999 Free Software Foundation, Inc.
51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
Everyone is permitted to copy and distribute verbatim copies
of this license document, but changing it is not allowed.
[This is the first released version of the Lesser GPL. It also counts
as the successor of the GNU Library Public License, version 2, hence
the version number 2.1.]
Preamble
The licenses for most software are designed to take away your
freedom to share and change it. By contrast, the GNU General Public
Licenses are intended to guarantee your freedom to share and change
free software--to make sure the software is free for all its users.
This license, the Lesser General Public License, applies to some
specially designated software packages--typically libraries--of the
Free Software Foundation and other authors who decide to use it. You
can use it too, but we suggest you first think carefully about whether
this license or the ordinary General Public License is the better
strategy to use in any particular case, based on the explanations below.
When we speak of free software, we are referring to freedom of use,
not price. Our General Public Licenses are designed to make sure that
you have the freedom to distribute copies of free software (and charge
for this service if you wish); that you receive source code or can get
it if you want it; that you can change the software and use pieces of
it in new free programs; and that you are informed that you can do
these things.
To protect your rights, we need to make restrictions that forbid
distributors to deny you these rights or to ask you to surrender these
rights. These restrictions translate to certain responsibilities for
you if you distribute copies of the library or if you modify it.
For example, if you distribute copies of the library, whether gratis
or for a fee, you must give the recipients all the rights that we gave
you. You must make sure that they, too, receive or can get the source
code. If you link other code with the library, you must provide
complete object files to the recipients, so that they can relink them
with the library after making changes to the library and recompiling
it. And you must show them these terms so they know their rights.
We protect your rights with a two-step method: (1) we copyright the
library, and (2) we offer you this license, which gives you legal
permission to copy, distribute and/or modify the library.
To protect each distributor, we want to make it very clear that
there is no warranty for the free library. Also, if the library is
modified by someone else and passed on, the recipients should know
that what they have is not the original version, so that the original
author's reputation will not be affected by problems that might be
introduced by others.
Finally, software patents pose a constant threat to the existence of
any free program. We wish to make sure that a company cannot
effectively restrict the users of a free program by obtaining a
restrictive license from a patent holder. Therefore, we insist that
any patent license obtained for a version of the library must be
consistent with the full freedom of use specified in this license.
Most GNU software, including some libraries, is covered by the
ordinary GNU General Public License. This license, the GNU Lesser
General Public License, applies to certain designated libraries, and
is quite different from the ordinary General Public License. We use
this license for certain libraries in order to permit linking those
libraries into non-free programs.
When a program is linked with a library, whether statically or using
a shared library, the combination of the two is legally speaking a
combined work, a derivative of the original library. The ordinary
General Public License therefore permits such linking only if the
entire combination fits its criteria of freedom. The Lesser General
Public License permits more lax criteria for linking other code with
the library.
We call this license the "Lesser" General Public License because it
does Less to protect the user's freedom than the ordinary General
Public License. It also provides other free software developers Less
of an advantage over competing non-free programs. These disadvantages
are the reason we use the ordinary General Public License for many
libraries. However, the Lesser license provides advantages in certain
special circumstances.
For example, on rare occasions, there may be a special need to
encourage the widest possible use of a certain library, so that it becomes
a de-facto standard. To achieve this, non-free programs must be
allowed to use the library. A more frequent case is that a free
library does the same job as widely used non-free libraries. In this
case, there is little to gain by limiting the free library to free
software only, so we use the Lesser General Public License.
In other cases, permission to use a particular library in non-free
programs enables a greater number of people to use a large body of
free software. For example, permission to use the GNU C Library in
non-free programs enables many more people to use the whole GNU
operating system, as well as its variant, the GNU/Linux operating
system.
Although the Lesser General Public License is Less protective of the
users' freedom, it does ensure that the user of a program that is
linked with the Library has the freedom and the wherewithal to run
that program using a modified version of the Library.
The precise terms and conditions for copying, distribution and
modification follow. Pay close attention to the difference between a
"work based on the library" and a "work that uses the library". The
former contains code derived from the library, whereas the latter must
be combined with the library in order to run.
GNU LESSER GENERAL PUBLIC LICENSE
TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
0. This License Agreement applies to any software library or other
program which contains a notice placed by the copyright holder or
other authorized party saying it may be distributed under the terms of
this Lesser General Public License (also called "this License").
Each licensee is addressed as "you".
A "library" means a collection of software functions and/or data
prepared so as to be conveniently linked with application programs
(which use some of those functions and data) to form executables.
The "Library", below, refers to any such software library or work
which has been distributed under these terms. A "work based on the
Library" means either the Library or any derivative work under
copyright law: that is to say, a work containing the Library or a
portion of it, either verbatim or with modifications and/or translated
straightforwardly into another language. (Hereinafter, translation is
included without limitation in the term "modification".)
"Source code" for a work means the preferred form of the work for
making modifications to it. For a library, complete source code means
all the source code for all modules it contains, plus any associated
interface definition files, plus the scripts used to control compilation
and installation of the library.
Activities other than copying, distribution and modification are not
covered by this License; they are outside its scope. The act of
running a program using the Library is not restricted, and output from
such a program is covered only if its contents constitute a work based
on the Library (independent of the use of the Library in a tool for
writing it). Whether that is true depends on what the Library does
and what the program that uses the Library does.
1. You may copy and distribute verbatim copies of the Library's
complete source code as you receive it, in any medium, provided that
you conspicuously and appropriately publish on each copy an
appropriate copyright notice and disclaimer of warranty; keep intact
all the notices that refer to this License and to the absence of any
warranty; and distribute a copy of this License along with the
Library.
You may charge a fee for the physical act of transferring a copy,
and you may at your option offer warranty protection in exchange for a
fee.
2. You may modify your copy or copies of the Library or any portion
of it, thus forming a work based on the Library, and copy and
distribute such modifications or work under the terms of Section 1
above, provided that you also meet all of these conditions:
a) The modified work must itself be a software library.
b) You must cause the files modified to carry prominent notices
stating that you changed the files and the date of any change.
c) You must cause the whole of the work to be licensed at no
charge to all third parties under the terms of this License.
d) If a facility in the modified Library refers to a function or a
table of data to be supplied by an application program that uses
the facility, other than as an argument passed when the facility
is invoked, then you must make a good faith effort to ensure that,
in the event an application does not supply such function or
table, the facility still operates, and performs whatever part of
its purpose remains meaningful.
(For example, a function in a library to compute square roots has
a purpose that is entirely well-defined independent of the
application. Therefore, Subsection 2d requires that any
application-supplied function or table used by this function must
be optional: if the application does not supply it, the square
root function must still compute square roots.)
These requirements apply to the modified work as a whole. If
identifiable sections of that work are not derived from the Library,
and can be reasonably considered independent and separate works in
themselves, then this License, and its terms, do not apply to those
sections when you distribute them as separate works. But when you
distribute the same sections as part of a whole which is a work based
on the Library, the distribution of the whole must be on the terms of
this License, whose permissions for other licensees extend to the
entire whole, and thus to each and every part regardless of who wrote
it.
Thus, it is not the intent of this section to claim rights or contest
your rights to work written entirely by you; rather, the intent is to
exercise the right to control the distribution of derivative or
collective works based on the Library.
In addition, mere aggregation of another work not based on the Library
with the Library (or with a work based on the Library) on a volume of
a storage or distribution medium does not bring the other work under
the scope of this License.
3. You may opt to apply the terms of the ordinary GNU General Public
License instead of this License to a given copy of the Library. To do
this, you must alter all the notices that refer to this License, so
that they refer to the ordinary GNU General Public License, version 2,
instead of to this License. (If a newer version than version 2 of the
ordinary GNU General Public License has appeared, then you can specify
that version instead if you wish.) Do not make any other change in
these notices.
Once this change is made in a given copy, it is irreversible for
that copy, so the ordinary GNU General Public License applies to all
subsequent copies and derivative works made from that copy.
This option is useful when you wish to copy part of the code of
the Library into a program that is not a library.
4. You may copy and distribute the Library (or a portion or
derivative of it, under Section 2) in object code or executable form
under the terms of Sections 1 and 2 above provided that you accompany
it with the complete corresponding machine-readable source code, which
must be distributed under the terms of Sections 1 and 2 above on a
medium customarily used for software interchange.
If distribution of object code is made by offering access to copy
from a designated place, then offering equivalent access to copy the
source code from the same place satisfies the requirement to
distribute the source code, even though third parties are not
compelled to copy the source along with the object code.
5. A program that contains no derivative of any portion of the
Library, but is designed to work with the Library by being compiled or
linked with it, is called a "work that uses the Library". Such a
work, in isolation, is not a derivative work of the Library, and
therefore falls outside the scope of this License.
However, linking a "work that uses the Library" with the Library
creates an executable that is a derivative of the Library (because it
contains portions of the Library), rather than a "work that uses the
library". The executable is therefore covered by this License.
Section 6 states terms for distribution of such executables.
When a "work that uses the Library" uses material from a header file
that is part of the Library, the object code for the work may be a
derivative work of the Library even though the source code is not.
Whether this is true is especially significant if the work can be
linked without the Library, or if the work is itself a library. The
threshold for this to be true is not precisely defined by law.
If such an object file uses only numerical parameters, data
structure layouts and accessors, and small macros and small inline
functions (ten lines or less in length), then the use of the object
file is unrestricted, regardless of whether it is legally a derivative
work. (Executables containing this object code plus portions of the
Library will still fall under Section 6.)
Otherwise, if the work is a derivative of the Library, you may
distribute the object code for the work under the terms of Section 6.
Any executables containing that work also fall under Section 6,
whether or not they are linked directly with the Library itself.
6. As an exception to the Sections above, you may also combine or
link a "work that uses the Library" with the Library to produce a
work containing portions of the Library, and distribute that work
under terms of your choice, provided that the terms permit
modification of the work for the customer's own use and reverse
engineering for debugging such modifications.
You must give prominent notice with each copy of the work that the
Library is used in it and that the Library and its use are covered by
this License. You must supply a copy of this License. If the work
during execution displays copyright notices, you must include the
copyright notice for the Library among them, as well as a reference
directing the user to the copy of this License. Also, you must do one
of these things:
a) Accompany the work with the complete corresponding
machine-readable source code for the Library including whatever
changes were used in the work (which must be distributed under
Sections 1 and 2 above); and, if the work is an executable linked
with the Library, with the complete machine-readable "work that
uses the Library", as object code and/or source code, so that the
user can modify the Library and then relink to produce a modified
executable containing the modified Library. (It is understood
that the user who changes the contents of definitions files in the
Library will not necessarily be able to recompile the application
to use the modified definitions.)
b) Use a suitable shared library mechanism for linking with the
Library. A suitable mechanism is one that (1) uses at run time a
copy of the library already present on the user's computer system,
rather than copying library functions into the executable, and (2)
will operate properly with a modified version of the library, if
the user installs one, as long as the modified version is
interface-compatible with the version that the work was made with.
c) Accompany the work with a written offer, valid for at
least three years, to give the same user the materials
specified in Subsection 6a, above, for a charge no more
than the cost of performing this distribution.
d) If distribution of the work is made by offering access to copy
from a designated place, offer equivalent access to copy the above
specified materials from the same place.
e) Verify that the user has already received a copy of these
materials or that you have already sent this user a copy.
For an executable, the required form of the "work that uses the
Library" must include any data and utility programs needed for
reproducing the executable from it. However, as a special exception,
the materials to be distributed need not include anything that is
normally distributed (in either source or binary form) with the major
components (compiler, kernel, and so on) of the operating system on
which the executable runs, unless that component itself accompanies
the executable.
It may happen that this requirement contradicts the license
restrictions of other proprietary libraries that do not normally
accompany the operating system. Such a contradiction means you cannot
use both them and the Library together in an executable that you
distribute.
7. You may place library facilities that are a work based on the
Library side-by-side in a single library together with other library
facilities not covered by this License, and distribute such a combined
library, provided that the separate distribution of the work based on
the Library and of the other library facilities is otherwise
permitted, and provided that you do these two things:
a) Accompany the combined library with a copy of the same work
based on the Library, uncombined with any other library
facilities. This must be distributed under the terms of the
Sections above.
b) Give prominent notice with the combined library of the fact
that part of it is a work based on the Library, and explaining
where to find the accompanying uncombined form of the same work.
8. You may not copy, modify, sublicense, link with, or distribute
the Library except as expressly provided under this License. Any
attempt otherwise to copy, modify, sublicense, link with, or
distribute the Library is void, and will automatically terminate your
rights under this License. However, parties who have received copies,
or rights, from you under this License will not have their licenses
terminated so long as such parties remain in full compliance.
9. You are not required to accept this License, since you have not
signed it. However, nothing else grants you permission to modify or
distribute the Library or its derivative works. These actions are
prohibited by law if you do not accept this License. Therefore, by
modifying or distributing the Library (or any work based on the
Library), you indicate your acceptance of this License to do so, and
all its terms and conditions for copying, distributing or modifying
the Library or works based on it.
10. Each time you redistribute the Library (or any work based on the
Library), the recipient automatically receives a license from the
original licensor to copy, distribute, link with or modify the Library
subject to these terms and conditions. You may not impose any further
restrictions on the recipients' exercise of the rights granted herein.
You are not responsible for enforcing compliance by third parties with
this License.
11. If, as a consequence of a court judgment or allegation of patent
infringement or for any other reason (not limited to patent issues),
conditions are imposed on you (whether by court order, agreement or
otherwise) that contradict the conditions of this License, they do not
excuse you from the conditions of this License. If you cannot
distribute so as to satisfy simultaneously your obligations under this
License and any other pertinent obligations, then as a consequence you
may not distribute the Library at all. For example, if a patent
license would not permit royalty-free redistribution of the Library by
all those who receive copies directly or indirectly through you, then
the only way you could satisfy both it and this License would be to
refrain entirely from distribution of the Library.
If any portion of this section is held invalid or unenforceable under any
particular circumstance, the balance of the section is intended to apply,
and the section as a whole is intended to apply in other circumstances.
It is not the purpose of this section to induce you to infringe any
patents or other property right claims or to contest validity of any
such claims; this section has the sole purpose of protecting the
integrity of the free software distribution system which is
implemented by public license practices. Many people have made
generous contributions to the wide range of software distributed
through that system in reliance on consistent application of that
system; it is up to the author/donor to decide if he or she is willing
to distribute software through any other system and a licensee cannot
impose that choice.
This section is intended to make thoroughly clear what is believed to
be a consequence of the rest of this License.
12. If the distribution and/or use of the Library is restricted in
certain countries either by patents or by copyrighted interfaces, the
original copyright holder who places the Library under this License may add
an explicit geographical distribution limitation excluding those countries,
so that distribution is permitted only in or among countries not thus
excluded. In such case, this License incorporates the limitation as if
written in the body of this License.
13. The Free Software Foundation may publish revised and/or new
versions of the Lesser General Public License from time to time.
Such new versions will be similar in spirit to the present version,
but may differ in detail to address new problems or concerns.
Each version is given a distinguishing version number. If the Library
specifies a version number of this License which applies to it and
"any later version", you have the option of following the terms and
conditions either of that version or of any later version published by
the Free Software Foundation. If the Library does not specify a
license version number, you may choose any version ever published by
the Free Software Foundation.
14. If you wish to incorporate parts of the Library into other free
programs whose distribution conditions are incompatible with these,
write to the author to ask for permission. For software which is
copyrighted by the Free Software Foundation, write to the Free
Software Foundation; we sometimes make exceptions for this. Our
decision will be guided by the two goals of preserving the free status
of all derivatives of our free software and of promoting the sharing
and reuse of software generally.
NO WARRANTY
15. BECAUSE THE LIBRARY IS LICENSED FREE OF CHARGE, THERE IS NO
WARRANTY FOR THE LIBRARY, TO THE EXTENT PERMITTED BY APPLICABLE LAW.
EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR
OTHER PARTIES PROVIDE THE LIBRARY "AS IS" WITHOUT WARRANTY OF ANY
KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE
LIBRARY IS WITH YOU. SHOULD THE LIBRARY PROVE DEFECTIVE, YOU ASSUME
THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
16. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN
WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY
AND/OR REDISTRIBUTE THE LIBRARY AS PERMITTED ABOVE, BE LIABLE TO YOU
FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR
CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE
LIBRARY (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING
RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A
FAILURE OF THE LIBRARY TO OPERATE WITH ANY OTHER SOFTWARE), EVEN IF
SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH
DAMAGES.
END OF TERMS AND CONDITIONS
How to Apply These Terms to Your New Libraries
If you develop a new library, and you want it to be of the greatest
possible use to the public, we recommend making it free software that
everyone can redistribute and change. You can do so by permitting
redistribution under these terms (or, alternatively, under the terms of the
ordinary General Public License).
To apply these terms, attach the following notices to the library. It is
safest to attach them to the start of each source file to most effectively
convey the exclusion of warranty; and each file should have at least the
"copyright" line and a pointer to where the full notice is found.
Copyright (C)
This library is free software; you can redistribute it and/or
modify it under the terms of the GNU Lesser General Public
License as published by the Free Software Foundation; either
version 2.1 of the License, or (at your option) any later version.
This library is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
Lesser General Public License for more details.
You should have received a copy of the GNU Lesser General Public
License along with this library; if not, write to the Free Software
Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
Also add information on how to contact you by electronic and paper mail.
You should also get your employer (if you work as a programmer) or your
school, if any, to sign a "copyright disclaimer" for the library, if
necessary. Here is a sample; alter the names:
Yoyodyne, Inc., hereby disclaims all copyright interest in the
library `Frob' (a library for tweaking knobs) written by James Random Hacker.
, 1 April 1990
Ty Coon, President of Vice
That's all there is to it!