6.1.1.3.2.7. linotp.lib.crypt module

access to all cryptographic aspects - declare the SecretObject to encapsulate security aspects

class linotp.lib.crypt.SecretObj(val, iv, preserve=True)

aes_decrypt(data_input)

support inplace aes decryption for the yubikey

Parameters:data_input – data, that should be decrypted Returns:the decrypted data

compare(key)

encryptPin()

getKey()

getPin()

hmac_digest(data_input, hash_algo)

linotp.lib.crypt.check(st)

calculate the checksum of st :param st: input string :return: the checksum code as 2 hex bytes

linotp.lib.crypt.createActivationCode(acode=None, checksum=True)

create the activation code

Parameters:

• acode – activation code or None
• checksum – flag to indicate, if a checksum will be calculated

Returns:

return the activation code

linotp.lib.crypt.createNonce(len=64)

create a nonce - which is a random string :param len: len of bytes to return :return: hext string

linotp.lib.crypt.decrypt(input, iv, id=0)

decrypt a variable from the given input with an initialiation vector

Parameters:

• input (buffer of bytes) – buffer, which contains the crypted value
• iv (buffer (20 bytes random)) – initilaitation vector
• id (int) – contains the id of which key of the keyset should be used

Returns:

decryted buffer

linotp.lib.crypt.decryptPassword(cryptPass)

linotp.lib.crypt.decryptPin(cryptPin)

linotp.lib.crypt.encrypt(data, iv, id=0)

encrypt a variable from the given input with an initialiation vector

Parameters:

• input (buffer of bytes) – buffer, which contains the value
• iv (buffer (20 bytes random)) – initilaitation vector
• id (int) – contains the id of which key of the keyset should be used

Returns:

encryted buffer

linotp.lib.crypt.encryptPassword(password)

linotp.lib.crypt.encryptPin(cryptPin)

linotp.lib.crypt.getSecret(id=0)

linotp.lib.crypt.getSecretDummy()

linotp.lib.crypt.get_rand_digit_str(length=16)

return a sting of digits with a defined length using the urandom

linotp.lib.crypt.geturandom(len=20)

get random - from the security module

Parameters:len – len of the returned bytes - defalt is 20 bytes Tyrpe len:int Returns:buffer of bytes

linotp.lib.crypt.hash(val, seed, algo=None)

linotp.lib.crypt.isWorldAccessible(filepath)

linotp.lib.crypt.kdf2(sharesecret, nonce, activationcode, len, iterations=10000, digest='SHA256', macmodule=<module 'Crypto.Hash.HMAC' from '/usr/lib/python2.7/dist-packages/Crypto/Hash/HMAC.pyc'>, checksum=True)

key derivation function

• takes the shareed secret, an activation code and a nonce to generate a new key

• the last 4 btyes (8 chars) of the nonce is the salt

• the last byte (2 chars) of the activation code are the checksum

• the activation code mitght contain ‘-‘ signs for grouping char blocks

  aabbcc-ddeeff-112233-445566

Parameters:

• sharedsecret – hexlified binary value
• nonce – hexlified binary value
• activationcode – base32 encoded value

linotp.lib.crypt.setupKeyFile(secFile, maxId)

linotp.lib.crypt.udecode(value)

unicode de escape the value - required to support non-unicode databases :param value: string to be deescaped :return: unicode value

linotp.lib.crypt.uencode(value)

unicode escape the value - required to support non-unicode databases :param value: string to be escaped :return: u encoded value

class linotp.lib.crypt.urandom

Bases: object

classmethod choice(array)

get one out of an array

Parameters:array – sequence - string or list Returns:array element

precision = 12

classmethod randint(start, end=None)

get random integer in between of start and end

Returns:random int

classmethod random()

get random float value betwee 0.0 and 1.0

Returns:float value

classmethod randrange(start, stop=None, step=1)

get one out of a range of values

Parameters:

• start – start of range
• stop – end value
• step – the step distance beween two values

Returns:

int value

classmethod uniform(start, end=None)

get a floating value between start and end

Parameters:

• start – start floafing value
• end – end floating value

Returns:

floating value between start and end

linotp.lib.crypt.zerome(bufferObject)

clear a string value from memory

Parameters:string (string or key buffer) – the string variable, which should be cleared Returns:

• nothing -