Login

web-key: Base64 Shared Secret for Access Control

Author:
sbw
Posted:
May 27, 2009
Language:
Python
Version:
1.0
Score:
-1 (after 1 ratings)

At the Internet Identity Workshop in May, 2009, I spoke to Alan Karp and Tyler Close of HP Labs about their research on authorization without identity. Here are my Delicious links on the subject.

This led me to write code to generate a "web-key," the shared secret needed to implement the access control method discussed.

In his paper, Tyler Close recommends 70 bits for the shared secret, encoded as a 13-character Base32 string. I used 72 bits, so the secret is a 12-character, URL-safe Base64 string without padding characters.

I'm new to Python and Django, so I welcome refinements!

1
2
3
4
5
6
7
8
9
class Foo(models.Model):
    secret = models.CharField(max_length=12, blank=True, editable=False)

    def generateSecret(self):
        s = struct.pack('L', random.getrandbits(32))
        s += struct.pack('L', random.getrandbits(32))
        s += struct.pack('L', random.getrandbits(8))
        self.secret = base64.urlsafe_b64encode(s[0:9])
        self.save()

More like this

  1. Serializer factory with Django Rest Framework by julio 5 months, 3 weeks ago
  2. Image compression before saving the new model / work with JPG, PNG by Schleidens 6 months, 1 week ago
  3. Help text hyperlinks by sa2812 7 months, 1 week ago
  4. Stuff by NixonDash 9 months, 2 weeks ago
  5. Add custom fields to the built-in Group model by jmoppel 11 months, 2 weeks ago

Comments

Please login first before commenting.