{"categories":[{"label":"Cryptography","url":"https://skillfed.io/packages/category/security-cryptography"}],"enrichment":{"capability":"Implements SPAKE2, a password-authenticated key exchange (PAKE) algorithm that allows two parties sharing a weak password to derive a strong shared secret for encrypted communication.","skillfed_tags":["cryptography","key-exchange","authentication"],"use_cases":["Device pairing protocols where one device generates a code and both devices use it as a one-time password to establish trust","Login systems where you want to avoid sending plaintext passwords over TLS by having both client and server derive a shared key from the password","Peer-to-peer applications needing symmetric key agreement without pre-established infrastructure or certificate authorities","Establishing encrypted channels between parties who have only memorized or shared a weak password out-of-band","Building key confirmation mechanisms to verify both parties derived the same key before using it for data encryption"],"what_it_does":"SPAKE2 is a pure-Python implementation of the SPAKE2 password-authenticated key exchange protocol. It solves the problem of two parties who only share a weak password needing to establish a strong shared secret for encrypted communication without prior key exchange infrastructure. The protocol resists both passive eavesdropping and active man-in-the-middle attacks: a passive attacker learns nothing about the password or derived key, while an active attacker gets only one guess per protocol execution with no offline dictionary attack possible.\n\nThe library provides three main classes: SPAKE2_A and SPAKE2_B for asymmetric roles (typically client and server), and SPAKE2_Symmetric for peer-to-peer scenarios where roles cannot be predetermined. The protocol requires only one message round trip to establish the session key, with an optional second round trip for key confirmation. All messages are bytestrings, and the default security level (Ed25519) produces 33-byte messages. The derived key can be used directly for HMAC or authenticated encryption, or fed into HKDF for deriving additional session keys.","worth_installing":"Yes, if you need PAKE for password-based key exchange. The implementation is stable (no known vulnerabilities, low install friction), MIT-licensed, and suitable for production use in pairing and login protocols. Dormant maintenance is acceptable for a mature cryptographic algorithm. Verify that the implementation meets your security audit requirements and interoperability needs before deployment."},"id":"spake2","links":{"html":"https://skillfed.io/packages/spake2","md":"https://skillfed.io/packages/spake2.md","pypi":"https://pypi.org/project/spake2/"},"maintenance":{"status":"dormant"},"meta":{"latest_release":"2024-09-25","license_spdx":null,"license_treatment":"permissive","name":"spake2","python_support":"unspecified","summary":"SPAKE2 password-authenticated key exchange (pure python)"},"popularity":{"monthly_downloads":708346,"position":5264,"tier":"top_15000"},"security":{"n_vulnerabilities":0},"version":"0.9"}