Package: bsrp
bsrpbsrpis a python implementation of the secure remote password protocol (SRP-6a).
This library enables a login flow in which the server provides the public value
B before the client reveals its own public value A. This enables a little bit
cleaner of a login flow. This library is designed for server-side use, with a mock
client side library included for testing and reference for frontend use.bsrphas a sister library with the same name implemented in javascripthere.UsageThe following example (taken from the test suite) showcases the flow of data
between the client and the server to achieve login authentication.frombsrp.clientimport(generate_a_pair,process_challenge,verify_sessionasclient_verify_session,)frombsrp.serverimport(generate_b_pair,generate_salt_and_verifier,verify_sessionasserver_verify_session,)identity="test"password="#yoloswag"# A user is initiated with a set identity and passwordsalt,verifier=generate_salt_and_verifier(identity,password)# The user initiates the login process by sending the identity# to the server. Using the verifier and salt, the server calculates# and calculates public value Bb,B=generate_b_pair(verifier)# Using the salt and public value B, the client generates# message M to prove to the serve that the password is correct.a,A=generate_a_pair()M,session_key=process_challenge(identity,password,salt,a,A,B)# The server then verifies the session and generates an evidence# key H_AMK for the client to use for mutual authentication.server_H_AMK=server_verify_session(identity,salt,verifier,A,b,M)assertserver_H_AMKisnotNone# The client then calculates its own H_AMK to verify the server# is legit.client_H_AMK=client_verify_session(A,M,session_key,server_H_AMK)assertclient_H_AMKisnotNone# Authentication successassertserver_H_AMK==client_H_AMKFunctionsUtilsSafetyException: Raised if SRP-6a safety checks fail_get_srp_prime(): Returns integer value of the 2048-bit SRP primeNote: you may set your own prime by overriding this method_get_srp_generator(): Returns integer value of the generator used to generate the SRP prime_generate_random_bytes(length: int): Returns cryptographically random bytes_to_bytes(obj: Any): Converts object to bytes_to_int(obj: Any): Converts object to integer_pad(obj: Any, length: int): Returns left padded byte-string representation of number_Hash(*args): Returns hash of concatenated argument objects_calculate_x(salt: bytes, identity: str, password: str): Returns the calculated
user secret parameter x_calculate_M(generator: int, prime: int, identity: str, salt: bytes, A: int, B: int, session_key: bytes): Returns the calculated evidence message MServerMessageException: raised when the message from the client does not match.generate_salt_and_verifier(identity: str, password: str)Returns a tuple of the
salt and verification keygenerate_b_pair(verifier: int): Returns private ephemeral b for later use and
public value B for the clientverify_session(identity: str, salt: bytes, verifier: int, A: int, b: int,M_client: bytes): Returns None if session is invalid, evidence key if message
from client is validClientEvidenceException: raised when server evidence key does not matchgenerate_a_pair(): Returns tuple of private ephemeral a and public value Aprocess_challenge(identity: str, password: str, salt: bytes, a: int, A: int, B: int): Returns tuple of message and private strong session keyverify_session(A: int, M: bytes, session_key: bytes, server_H_AMK: bytes):
Returns None if session is invalid, evidence key if the server was mutually
authenticated