Login

web-key: Base64 Shared Secret for Access Control

Author:
sbw
Posted:
May 27, 2009
Language:
Python
Version:
1.0
Tags:
password web-key webkey zbac access-control
Score:
-1 (after 1 ratings)

At the Internet Identity Workshop in May, 2009, I spoke to Alan Karp and Tyler Close of HP Labs about their research on authorization without identity. Here are my Delicious links on the subject.

This led me to write code to generate a "web-key," the shared secret needed to implement the access control method discussed.

In his paper, Tyler Close recommends 70 bits for the shared secret, encoded as a 13-character Base32 string. I used 72 bits, so the secret is a 12-character, URL-safe Base64 string without padding characters.

I'm new to Python and Django, so I welcome refinements!

1
2
3
4
5
6
7
8
9
class Foo(models.Model):
    secret = models.CharField(max_length=12, blank=True, editable=False)

    def generateSecret(self):
        s = struct.pack('L', random.getrandbits(32))
        s += struct.pack('L', random.getrandbits(32))
        s += struct.pack('L', random.getrandbits(8))
        self.secret = base64.urlsafe_b64encode(s[0:9])
        self.save()

More like this

  1. Truncate HTML without breaking tags by olau 6 years, 2 months ago
  2. Transparently encrypt ORM fields using OpenSSL (via M2Crypto) by ncoghlan 3 years, 11 months ago
  3. Sign a string using SHA1, then shrink it using url-safe base65 by simon 6 years, 10 months ago
  4. Controller Class for Views by jovialbard 2 years, 2 months ago
  5. FieldsetForm by Ciantic 8 years, 2 months ago

Comments

Please login first before commenting.