HOTP and TOTP should also have optional backends (#5402)

This commit is contained in:
Paul Kehrer 2020-08-15 15:34:59 -05:00 committed by GitHub
parent e52b861d75
commit 0fa77f1530
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
3 changed files with 12 additions and 8 deletions

View file

@ -18,7 +18,7 @@ codes (HMAC).
.. currentmodule:: cryptography.hazmat.primitives.twofactor.hotp
.. class:: HOTP(key, length, algorithm, backend, enforce_key_length=True)
.. class:: HOTP(key, length, algorithm, backend=None, enforce_key_length=True)
.. versionadded:: 0.3
@ -49,15 +49,15 @@ codes (HMAC).
:param cryptography.hazmat.primitives.hashes.HashAlgorithm algorithm: A
:class:`~cryptography.hazmat.primitives.hashes`
instance.
:param backend: A
:param backend: An optional
:class:`~cryptography.hazmat.backends.interfaces.HMACBackend`
instance.
:param enforce_key_length: A boolean flag defaulting to True that toggles
whether a minimum key length of 128 :term:`bits` is enforced. This
exists to work around the fact that as documented in `Issue #2915`_,
the Google Authenticator PAM module by default generates 80 bit keys.
If this flag is set to False, the application develop should implement
additional checks of the key length before passing it into
If this flag is set to False, the application developer should
implement additional checks of the key length before passing it into
:class:`~cryptography.hazmat.primitives.twofactor.hotp.HOTP`.
.. versionadded:: 1.5
@ -141,7 +141,7 @@ similar to the following code.
.. currentmodule:: cryptography.hazmat.primitives.twofactor.totp
.. class:: TOTP(key, length, algorithm, time_step, backend, enforce_key_length=True)
.. class:: TOTP(key, length, algorithm, time_step, backend=None, enforce_key_length=True)
TOTP objects take a ``key``, ``length``, ``algorithm`` and ``time_step``
parameter. The ``key`` should be :doc:`randomly generated bytes
@ -173,7 +173,7 @@ similar to the following code.
:class:`~cryptography.hazmat.primitives.hashes`
instance.
:param int time_step: The time step size. The recommended size is 30.
:param backend: A
:param backend: An optional
:class:`~cryptography.hazmat.backends.interfaces.HMACBackend`
instance.
:param enforce_key_length: A boolean flag defaulting to True that toggles

View file

@ -9,6 +9,7 @@ import struct
import six
from cryptography.exceptions import UnsupportedAlgorithm, _Reasons
from cryptography.hazmat.backends import _get_backend
from cryptography.hazmat.backends.interfaces import HMACBackend
from cryptography.hazmat.primitives import constant_time, hmac
from cryptography.hazmat.primitives.hashes import SHA1, SHA256, SHA512
@ -18,8 +19,9 @@ from cryptography.hazmat.primitives.twofactor.utils import _generate_uri
class HOTP(object):
def __init__(
self, key, length, algorithm, backend, enforce_key_length=True
self, key, length, algorithm, backend=None, enforce_key_length=True
):
backend = _get_backend(backend)
if not isinstance(backend, HMACBackend):
raise UnsupportedAlgorithm(
"Backend object does not implement HMACBackend.",

View file

@ -5,6 +5,7 @@
from __future__ import absolute_import, division, print_function
from cryptography.exceptions import UnsupportedAlgorithm, _Reasons
from cryptography.hazmat.backends import _get_backend
from cryptography.hazmat.backends.interfaces import HMACBackend
from cryptography.hazmat.primitives import constant_time
from cryptography.hazmat.primitives.twofactor import InvalidToken
@ -19,9 +20,10 @@ class TOTP(object):
length,
algorithm,
time_step,
backend,
backend=None,
enforce_key_length=True,
):
backend = _get_backend(backend)
if not isinstance(backend, HMACBackend):
raise UnsupportedAlgorithm(
"Backend object does not implement HMACBackend.",