Package: onetimepass
VersionsCurrent development release:onetimepass-master.tar.gzChangelogVersionDateChanges1.0.12015-07-31fixed tests and build system,extended test coverage with Py3.5, PyPy and PyPy3,1.0.02015-07-31skipping spaces if they are given in secret,test suite made more reliable,0.3.02014-08-16configurable digest method,configurable token length,configurable TOTP interval length,0.2.22013-07-12license clarification,removal of compiled documentation from the sources,0.2.12013-07-12support for unicode secrets,preliminary support for Travis CI,0.2.02013-04-11added compatibility with Python 3.x,removed compatibility with Python 2.5 and earlier,0.1.22013-01-23added automated case fold to secret,0.1.12013-12-20internal code improvements,documentation,0.1.02011-12-19(initial public release)What is OneTimePassOneTimePass (actuallyonetimepass) is a module for generating one-time
passwords, namely HOTPs (HMAC-based one-time passwords) and TOTPs (time-based
one-time passwords). They are used eg. within Google Authenticator application
for Android or iPhone.How to installTo install the library, you can either usepip, or just download it
separately. Installing inpipis the simplest. Assuming you are installing
it system-wide:$ sudo pip install onetimepass(if you are installing it in virtualenv, you do not need “sudo” part).Alternatively, you can follow the download link above and unpack in some
directory on yoursys.path, or clone it as Git submodule to your own
directory.How to use OneTimePassYou can use this module in the following way:Install module (download it into your application’s directory or into modules
directory)To get time-based token you invoke it like that:import onetimepass as otp
my_secret = 'MFRGGZDFMZTWQ2LK'
my_token = otp.get_totp(my_secret)Notemy_secretis case-insensitive, also spaces are ignored. This means you
can provide your users with more readable representations of the secrets
(eg.mfrg gzdf mztw q2lkinstead ofMFRGGZDFMZTWQ2LK) and pass them
unchanged to library. Same applies to other functions accepting secrets in
this library.To get HMAC-based token you invoke it like that:import onetimepass as otp
my_secret = 'MFRGGZDFMZTWQ2LK'
my_token = otp.get_hotp(my_secret, intervals_no=3)whereintervals_nois the number of the current trial (if checking on
the server, you have to check several values, higher than the last
successful one, determined for previous successful authentications).To check time-based token you invoke it like that:import onetimepass as otp
my_secret = 'MFRGGZDFMZTWQ2LK'
my_token = 123456 # should be probably from some user's input
is_valid = otp.valid_totp(token=my_token, secret=my_secret)To check HMAC-based token you invoke it like that:import onetimepass as otp
my_secret = 'MFRGGZDFMZTWQ2LK'
my_token = 123456 # should be probably from some user's input
last_used = 5 # store last valid interval somewhere else
is_valid = otp.valid_hotp(token=my_token, secret=my_secret, last=last_used)where:lastargument (in this case being assignedlast_used) is the
number of the last successfully checked interval number (asvalid_totp()will skip it and start checking from the next interval
number)is_validis being assigned value ofFalseifmy_tokenhas not
been identified as valid OTP for given secret (my_secret) and checked
interval range. If it has been successful,is_validis assigned a
number of the working interval number (it should be saved into the
database and supplied to the function aslastargument next time the
password is being checked, so you cannot use the same token again).LicenseLicense for this library is available inLICENSE.rstfile, in the same
directory. Online version is availablehere.