def from_data(
authtkt_secret, payload_secret, uid, data=None, ip='0.0.0.0',
tokens=(), base64=True, ts=None, encoding='utf-8'):
data = json.dumps(data or {})
data = _encrypt_userdata(
to_bytes(data, encoding), to_bytes(payload_secret, encoding))
auth_ticket = AuthTkt(
authtkt_secret, uid, data, ip, tokens, base64, ts,
encoding=encoding)
return EncryptedAuthTkt(auth_ticket, payload_secret)
def _encrypt_userdata(cleartext, secret):
hmacKey, encKey, salt = _derive_keys(secret)
# get 128 bit random iv
iv = os.urandom(16)
# Add HMAC to cleartext so that we can check during decrypt if we got
# the right cleartext back. We are doing sign-then-encrypt, which lets
# us encrypt empty cleartext (otherwise we'd need to pad with some
# string to encrypt). Practical Cryptography by Schneier & Ferguson
# also recommends doing it in this order in section 8.2.
mac = hmac.new(hmacKey, cleartext + iv + salt, hashlib.sha256).hexdigest()
ciphertext = _encipher(
zlib.compress(cleartext + to_bytes(mac)), encKey, iv, algorithms.AES)
return (
base64.b64encode(iv + salt + ciphertext)
.strip()
.replace(b'\n', b'')
)
def _digest0(self):
parts = (
self._encode_ip(self.ip), self._encode_ts(self.ts),
to_bytes(self.secret), to_bytes(self.uid), b'\0',
to_bytes(self.tokens), b'\0', to_bytes(self.data))
return hashlib.md5(b''.join(parts)).hexdigest()
def _digest(self):
parts = [self._digest0(), self.secret]
parts = b''.join([to_bytes(part) for part in parts])
return hashlib.md5(parts).hexdigest()
def test_encodes_unicode_strings(self):
self.assertEqual(compat.to_bytes(u'\u2603'), b'\xe2\x98\x83')
def test_returns_encoded_byte_string(self):
returns = compat.to_bytes('test')
self.assertIsInstance(returns, bytes)
self.assertEqual(returns, b'test')
def test_encodes_unicode_strings(self):
self.assertEqual(compat.to_bytes(u'\u2603'), b'\xe2\x98\x83')
def test_returns_encoded_byte_string(self):
returns = compat.to_bytes('test')
self.assertIsInstance(returns, bytes)
self.assertEqual(returns, b'test')
def __init__(self, auth_ticket, payload_secret):
self.auth_ticket = auth_ticket
self._payload_secret = to_bytes(payload_secret)
def _digest0(self):
parts = (self._encode_ip(self.ip), self._encode_ts(self.ts),
to_bytes(self.secret), to_bytes(self.uid), b'\0',
to_bytes(self.tokens), b'\0', to_bytes(self.data))
return self.hash_algo(b''.join(parts)).hexdigest()
def _digest(self):
parts = [self._digest0(), self.secret]
parts = b''.join([to_bytes(part) for part in parts])
return self.hash_algo(parts).hexdigest()