Spake2

Latest version: v0.8

Safety actively analyzes 619231 Python packages for vulnerabilities to keep your Python projects secure.

Scan your dependencies

0.8

API BREAK (but not a compatibility break)

Applications using this release will start up faster. The library includes
multiple groups (with different message sizes, performance, and security
levels), and each group uses a different blinding factor. These factors take
a relatively long time to compute. The previous release did this computation
for all groups, even ones that the application never imported. This release
changes the import API to avoid the unnecessary calculations, which saves
about 400ms at import time on my 2016-era laptop (and several seconds on a
Raspberry Pi).

Applications must use different "import" statements when upgrading to this
release ("from spake2.parameters.ed25519 import ParamsEd25519" instead of
"from spake2 import ParamsEd25519"). However this release retains message
compatibility with spake2-0.7: apps using 0.8 can interoperate with apps
using 0.7 without problems.

0.7

or later: the session keys will never match.

pypy3 support has been dropped, until pypy3 handles python3.3 or later (it
currently implements the equivalent of python3.2).

python-spake2 now depends on the "hkdf" package. Tox and py.test are now used
for running tests. setup.py has been switched from distutils to setuptools.

0.3

Use the faster "M=N" blinding factors for SPAKE2_Symmetric, instead of
running two sessions in parallel and combining the results. This gets the
same speed and message size as the asymmetric (SPAKE2_A/SPAKE2_B) approach,
and is probably safe (see README for the security proofs).

0.2

Use Ed25519 group/parameters by default (improves speed, security, and
message size). Note that both sides must use the same parameter set for
compatibility.

0.1

Initial release. Includes SPAKE2_A/SPAKE2_B, and SPAKE2_Symmetric. Provides
three integer-group parameter sets (Params1024, Params2048, Params3072).

Links

Releases

Has known vulnerabilities

© 2024 Safety CLI Cybersecurity Inc. All Rights Reserved.