def encrypt_pin(pin, iv=None, hsm=None):
"""
returns a concatenated 'iv:crypt'
"""
if not iv:
iv = geturandom(16)
enc_pin = encryptPin(pin, iv=iv, hsm=hsm)
return enc_pin
def _rollout_1(self, params):
'''
do the rollout 1 step
1. https://linotpserver/admin/init?
type=ocra&
genkey=1&
sharedsecret=1&
user=BENUTZERNAME&
session=SESSIONKEY
=>> "serial" : SERIENNUMMER, "sharedsecret" : DATAOBJECT,
"app_import" : IMPORTURL
- genSharedSecret - vom HSM oder urandom ?
- app_import : + linotp://
+ ocrasuite ->> default aus dem config:
(DefaultOcraSuite)
+ sharedsecret (Länge wie ???)
+ seriennummer
- seriennummer: uuid ??
- token wird angelegt ist aber nicht aktiv!!! (counter == 0)
'''
sharedSecret = params.get('sharedsecret', None)
if sharedSecret == '1':
# preserve the rollout state
self.addToTokenInfo('rollout', '1')
# preserve the current key as sharedSecret
secObj = self._get_secret_object()
key = secObj.getKey()
encSharedSecret = encryptPin(key)
self.addToTokenInfo('sharedSecret', encSharedSecret)
info = {}
uInfo = {}
info['sharedsecret'] = key
uInfo['sh'] = key
info['ocrasuite'] = self.getOcraSuiteSuite()
uInfo['os'] = self.getOcraSuiteSuite()
info['serial'] = self.getSerial()
uInfo['se'] = self.getSerial()
info['app_import'] = 'lseqr://init?%s' % (urllib.urlencode(uInfo))
del info['ocrasuite']
self.info = info
self.token.LinOtpIsactive = False
return
def encrypt_pin(pin: str):
"""
encrypt a given pin
:param pin:
:return: a concatenated 'iv:crypt'
"""
iv = utils.geturandom(16)
enc_pin = utils.encryptPin(pin.encode("utf-8"), iv=iv)
return enc_pin
def check_encrypted_pin(pin: str, encrypted_pin: bytes, iv: bytes) -> bool:
"""
check an encrypted against a given pin
:param encrypted_pin: hex binary
:param iv: hex binary iv from former decryption step
:param pin: string
:return: boolean
"""
crypted_pin = utils.encryptPin(pin.encode("utf-8"), iv)
# TODO: position independend compare
if encrypted_pin == crypted_pin.encode("utf-8"):
return True
return False
def _transform_action(action):
"""
transform the action, especialy the secret parameter of the url
"""
servers = []
name, _sep, values = action.partition('=')
for value in values.split(' '):
# decompose the server url to identify, if there is a secret inside
parsed_server = urlparse.urlparse(value)
# the urlparse has a bug,, where in elder versions, the
# path is not split from the query
if not parsed_server.query:
path, _sep, query = parsed_server.path.partition('?')
else:
path = parsed_server.path
query = parsed_server.query
# in gereal url parsing allows mutiple entries per key
# but we support here only one
params = urlparse.parse_qs(query)
for key, entry in params.items():
params[key] = entry[0]
# finally we found the query parameters
if 'secret' in params:
secret = params['secret']
params['encsecret'] = encryptPin(secret)
del params['secret']
# build the server url with the encrypted param:
# as the named tuple is not updateable, we have to convert this
# into an list to make the update and then back to a tuple to
# create an url from this
parsed_list = list(parsed_server[:])
parsed_list[ForwardServerPolicy.Path_index] = path.strip()
parsed_list[ForwardServerPolicy.Query_index] = \
urllib.urlencode(params)
server_url = urlparse.urlunparse(tuple(parsed_list))
servers.append(server_url)
ret = '='.join([name, ' '.join(servers)])
return ret
def encryptPin(self):
self._setupKey_()
res = encryptPin(self.bkey)
self._clearKey_(preserve=self.preserve)
return res