pysrp | Python implementation of the Secure Remote Password protocol | Authentication library
kandi X-RAY | pysrp Summary
kandi X-RAY | pysrp Summary
SRP is a cryptographically strong authentication protocol for password-based, mutual authentication over an insecure network connection. Unlike other common challenge-response autentication protocols, such as Kerberos and SSL, SRP does not rely on an external infrastructure of trusted key servers or certificate management. Instead, SRP server applications use verification keys derived from each user’s password to determine the authenticity of a network connection. SRP provides mutual-authentication in that successful authentication requires both sides of the connection to have knowledge of the user’s password. If the client side lacks the user’s password or the server side lacks the proper verification key, the authentication will fail. Unlike SSL, SRP does not directly encrypt all data flowing through the authenticated connection. However, successful authentication does result in a cryptographically strong shared key that can be used for symmetric-key encryption. For a full description of the pysrp package and the SRP protocol, please refer to the [pysrp documentation] Note: RFC5054 now provides the de-facto standard for the hashing algorithm used for interoperable SRP implementations. When using pysrp to interact with another SRP implementation, use the srp.rfc5054_enable() method to enable RFC5054 compatibility. Otherwise a pysrp-specific default implementation will be used.
Support
Quality
Security
License
Reuse
Top functions reviewed by kandi - BETA
- Create a salt verification key
- Convert bytes to a long integer
- Generate a random number of bytes
- Binary division
- Number of bytes
- Returns the constant value for the ng_type
- Calculate and return the N - gram
- Convert a binary number to a byte string
- Generate X
- Calculate the hash of a binary string
- Calculate X
- Convert an integer to bytes
- Generate a hash of the given arguments
- Compute the binary hash
- Load a function from SSL
- Generate a hexdigest hash of two strings
- Compute the hash of the given hash
- Return a random n bytes
pysrp Key Features
pysrp Examples and Code Snippets
Community Discussions
Trending Discussions on pysrp
QUESTION
Amazon provides iOS, Android, and Javascript Cognito SDKs that offer a high-level authenticate-user operation.
For example, see Use Case 4 here:
https://github.com/aws/amazon-cognito-identity-js
However, if you are using python/boto3, all you get are a pair of primitives: cognito.initiate_auth
and cognito.respond_to_auth_challenge
.
I am trying to use these primitives along with the pysrp
lib authenticate with the USER_SRP_AUTH
flow, but what I have is not working.
It always fails with "An error occurred (NotAuthorizedException) when calling the RespondToAuthChallenge operation: Incorrect username or password." (The username/password pair work find with the JS SDK.)
My suspicion is I'm constructing the challenge response wrong (step 3), and/or passing Congito hex strings when it wants base64 or vice versa.
Has anyone gotten this working? Anyone see what I'm doing wrong?
I am trying to copy the behavior of the authenticateUser
call found in the Javascript SDK:
https://github.com/aws/amazon-cognito-identity-js/blob/master/src/CognitoUser.js#L138
but I'm doing something wrong and can't figure out what.
...ANSWER
Answered 2017-Jan-09 at 18:50Unfortunately it's a hard problem since you don't get any hints from the service with regards to the computations (it mainly says not authorized as you mentioned).
We are working on improving the developer experience when users are trying to implement SRP on their own in languages where we don't have an SDK. Also, we are trying to add more SDKs.
As daunting as it sounds, what I would suggest is to take the Javascript or the Android SDK, fix the inputs (SRP_A, SRP_B, TIMESTAMP) and add console.log statements at various points in the implementation to make sure your computations are similar. Then you would run these computations in your implementation and make sure you are getting the same. As you have suggested, the password claim signature needs to be passed as a base64 encoded string to the service so that might be one of the issues.
Some of the issues I encountered while implementing this was related to BigInteger library differences (the way they do byte padding and transform negative numbers to byte arrays and inversely).
Community Discussions, Code Snippets contain sources that include Stack Exchange Network
Vulnerabilities
No vulnerabilities reported
Install pysrp
You can use pysrp like any standard Python library. You will need to make sure that you have a development environment consisting of a Python distribution including header files, a compiler, pip, and git installed. Make sure that your pip, setuptools, and wheel are up to date. When using pip it is generally recommended to install packages in a virtual environment to avoid changes to the system.
Support
Reuse Trending Solutions
Find, review, and download reusable Libraries, Code Snippets, Cloud APIs from over 650 million Knowledge Items
Find more librariesStay Updated
Subscribe to our newsletter for trending solutions and developer bootcamps
Share this Page