Package: pwdsphinx
sphinx: a passwordStore thatPerfectlyHides fromItself (NoXaggeration)pwdsphinx is python wrapper around libsphinx - a cryptographic password storage
as described inhttps://eprint.iacr.org/2015/1099DependenciesYou needlibsphinxandlibequihashfor the python reference frontend.You need also to installpysodiumusing either your OS package
manager or pip.If you want to use also the websphinx browser extension you need to
install also an X11 variant of pinentry from the gnupg project:eitherapt-get install pinentry-qtorapt-get install pinentry-gtk2orapt-get install pinentry-gnome3orapt-get install pinentry-fltk(or anything equivalent toapt-get installon your OS)Installationpip3 install pwdsphinxshould get you started.APIsphinxlibis actypes-based python wrapper aroundlibsphinx, so
you can build whatever you fancy immediately in python. The interface
exposed wraps the 3 sphinx functions from the library like this:def challenge(pwd)returns bfac and chaldef respond(chal, secret)return the responsedef finish(pwd, bfac, resp)returns the raw 32 byte password.Server/ClientSince the sphinx protocol only makes sense if the "device" is
somewhere else than where you type your password, pwdsphinx
comes with a server implemented in py3 which you can host off-site
from your usual desktop/smartphone. Also a client is supplied which is
able to communicate with the server and manage passwords.Both the client and the server can be configured by any of the
following files:/etc/sphinx/config~/.sphinxrc~/.config/sphinx/config./sphinx.cfgFiles are parsed in this order, this means global settings can be
overridden by per-user and per-directory settings.oracle - the serverpwdsphinx comes with a python reference implementation of a extended sphinx
server called oracle.The server can be "configured" by changing the variables in the[server]section of the config file.Theaddressis the IP address on which the server is listening,
default islocalhost- you might want to change that.Theportwhere the server is listening is by default 2355.datadirspecifies the data directory where all the device "secrets"
are stored, this defaults to "data/" in the current directory. You
might want to back up this directory from time to time to an encrypted
medium.verboseenables logging to standard output.timeoutsets the timeout for any connection the server keeps open.max_kidssets the number maximum requests handled in parallel. Thetimeoutconfig variable makes sure that all handlers are recycled in
predictable time.rl_decayspecifies the number of seconds after which a ratelimit level
decays to an easier difficulty.rl_thresholdincrease the difficulty of ratelimit puzzles if not
decaying.rl_gracetimegracetime in seconds added to the expcted time to solve
a rate-limiting puzzle.Change these settings to fit your needs. Starting the server
can be done simply by:oraclesphinx - the clientThis is the client that connects to the oracle to manage passwords
using the extended sphinx protocol.Client ConfigurationLike the server, the client can be configured changing the settings in
the[client]section of the config file. Thehostandportshould
match what you set in the oracle.The datadir (default:~/.sphinx) variable holds the location for your client
parameters. Particularly it contains a masterkey which is used to derive
secrets. The master key - if not available - is generated by issuing an init
command. Youshouldback up and encrypt this master key.rwd_keystoggles if the master password is required for
authentication of management operations. If it is False it protects
against offline master password bruteforce attacks - which is also a
security guarantee of the original SPHINX protocol. The drawback is
that for known (host,username) tuples the seeds/blobs can be
changed/deleted by an attacker if the clients masterkey is available
to them. But neither the master nor the account password can leak this
way. This is merely a denial-of-service vector. If rwd_keys is True,
then this eliminates the denial-of-service vector, but instead
eliminates the offline-bruteforce guarantee of the SPHINX
protocol. Note that the oracle is oblivious to this setting, this is
purely a client-side toggle, in theory it is possible to have
different settings for different "records" on the oracle.validate_passwordStores a check digit of 5 bits in on the oracle,
this helps to notice most typos of the master password, while
decreasing security slightly.OperationsThe client provides the following operations: Create, Get, Change, Commit,
Undo, List and Delete. All operations need a username and a site this
password belongs to, even if they're only empty strings.Create passwordCreating a new password for a site is easy, pass your "master"
password on standard input to the client, and provide parameters like
in this example:echo -n 'my master password' | sphinxy create username example.com ulsd 0 ' !"#$%&\'()*+,-./:;<=>?@[\\]^_`{|}~'The parameters to the client arecreatefor the operation, thenusernamefor the username on the siteexample.comthen a combination of the
lettersulsdand the0for the size of the final password. The lettersulsdstand in order for the following character classes:uupper-case
letters,llower-case letters,ssymbols anddfor digits. Thesis a
short-cut to allow all of the symbols, if you have a stupid server that limits
some symbols, you can specify the allowed symbols explicitly. Currently these
are the symbols supported (note the leading space char):!"#$%&'()*+,-./:;<=>?@[\]^_`{|}~Be careful, if you specify these on the command-line you'll have to
escape the quotes you use for enclosing this list and possibly the
backslash char that is also part of this list. In thecreate usernameexample above the symbols are correctly escaped, in case you
need to copy/paste them.If you do not provide password rules, they will be defaulting to 'ulsd' and
length as long as possible.If the command runs successfully - the resulting new high-entropy password
according to the given rules is printed to the console.In case for some reason you cannot use random passwords with your
account, or you want to store a "password" that you cannot change,
like a PIN code for example, or a passphrase shared with your
colleagues, you can specify a maximuxm 38 characte long password, that
will be generated by the SPHINX client for you. In that case the
command line looks like this (note the same syntax also works for thechangeoperation)echo -n 'my master password' | sphinx create username example.com "correct_battery-horse#staple"In this case you cannot specify neither the accepted character
classes, nor the size, nor symbols.Note1, since the master password is not used to encrypt anything, you can
actually use different "master" passwords for different user/site combinations.Note2, using echo is only for demonstration, you should use something like this
instead (or even directly getpwd from the contrib directory):echo GETPIN | pinentry | grep '^D' | cut -c3- | sphinx create username example.com ulsd 0Using pinentry you can go fancy and do double password input, and even have
something checking password quality for you, check it out, it's quite
versatile.Get passwordGetting a password from the sphinx oracle works by running the
following command:echo -n 'my master password' | sphinx get username example.comHere again you supply your master password on standard input, provide
thegetoperation as the first parameter, yourusernameas the 2nd
and thesiteas the 3rd parameter. The resulting password is
returned on standard output.Change passwordYou might want to (or are forced to regularly) change your password, this
is easy while you can keep your master password the unchanged (or you
can change it too, if you want). The command is this:echo -en 'my master password\nnew masterpassword' | sphinx change username example.com 'ulsd' 0 ' !"#$%&\'()*+,-./:;<=>?@[\\]^_`{|}~'Here again you supply your master password on standard input, but
separated by a new-line you also provide the new master password. The
new master password can be the same as the old, but can also be a new
password if you want to change also the master password. You provide
thechangeoperation as the first parameter to the client, yourusernameas the 2nd and thesiteas the 3rd parameter.  You also
can provide similar password generation rule parameters that were also
used to create the original password, in case your account has new
password rules and you want/have to accomodate them. Your new new
password is returned on standard output.Committing a changed passwordAfter changing the password, you will still get the old password when runningget. To switch to use the new password you have to commit the changes withecho -n 'my master password' | sphinx commit username example.comUndoing a password commitIf you somehow messed up and have to go back to use the old password, you can
undo committing your password using:echo -n 'my master password' | sphinx undo username example.comDeleting passwordsIn case you want to delete a password, you can do using the following
command:echo -n "my master password" | sphinx delete username example.comYou provide thedeleteoperation as the first parameter to the
client, yourusernameas the 2nd and thesiteas the 3rd
parameter. This command does not provide anything on standard output
in case everything goes well.QR code configIn case you want to use phone with the same sphinx server, you need to export
your config to the phone via a QR code.sphinx qrWill display a QR code containing only public information - like the server
host and port, and if you use rwd_keys. This is mostly useful if you want to
share your setup with a friend or family.If you want to connect your own phone to the setup used with pwdsphinx, you
also need to export your client secret in the QR code:sphinx qr keyThis contains your client secret, and you should keep this QR code
confidential. Make sure there is no cameras making copies of this while this QR
code is displayed on your screen.If for whatever reason you want to display the QR code as an SVG, just append
thesvgkeyword to the end of thesphinx qrcommand.X11 frontendYou can find a bunch of shell-scripts that are based onpinentry-(gtk|qt),xinput,xdotoolanddmenu, the top-level
entry to these is thedmenu-sphinx.shscript, which stores its
history of entered hostnames in~/.sphinx-hosts- if the hosts are
in any way sensitive, you might want to link this file to/dev/null. Thecontrib/README.mdshould give you an idea of how
else to combine these scripts.CreditsThis project was funded through the NGI0 PET Fund, a fund established
by NLnet with financial support from the European Commission's Next
Generation Internet programme, under the aegis of DG Communications
Networks, Content and Technology under grant agreement No 825310.