srptools

What it is and what it does

srptools provides a complete implementation of the Secure Remote Password (SRP) protocol, a password-authenticated key agreement (PAKE) mechanism that allows two parties to authenticate each other and establish a shared session key without ever transmitting the password over the network. The package supports both Python 2 and 3 and offers two interfaces: a programmatic API via SRPContext, SRPServerSession, and SRPClientSession classes, and a command-line utility for testing and integration.

The library handles the cryptographic details of SRP authentication, including user data triplet generation (username, password verifier, and salt), session key derivation, and optional proof verification for mutual authentication. It supports both hex and base64 encoding of values, allows session restoration via private key storage, and can raise SRPException to signal authentication failures that should halt the process. The package has no external runtime dependencies for API use, making it lightweight for embedding in applications.

Use it for:

• Implement password-based authentication in web applications or APIs where you want to avoid transmitting passwords over the network.
• Build peer-to-peer or distributed systems requiring mutual authentication without relying on a central certificate authority.
• Add SRP-based authentication to IoT or embedded systems where password security and key exchange are critical.
• Test or prototype SRP protocol implementations using the command-line utility for debugging authentication flows.
• Replace basic password authentication in legacy systems with a cryptographically stronger PAKE mechanism.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Implements Secure Remote Password (SRP) protocol for password-authenticated key agreement, providing both programmatic API and command-line tools for client-server authentication without transmitting passwords.

Yes, if you need SRP authentication. The package is stable, has no runtime dependencies, and is actively maintained. However, note that the latest release was in 2020 and Python 2 support is included; verify that the supported Python versions and any cryptographic assumptions align with your security requirements before production use.

Install

srptools on PyPI

pip install srptools

uv add srptools

poetry add srptools

Installing srptools

Before you install

Low install friction with no runtime dependencies. Package is actively maintained with recent commits, though the latest release was in 2020; the repository remains active and unarchived.

License in practice

BSD 3-Clause License is permissive, allowing commercial and private use with minimal restrictions; you may use and modify the code freely provided you include the license notice.

Quickstart

from srptools import SRPContext, SRPServerSession, SRPClientSession

context = SRPContext('alice', 'password123')
username, password_verifier, salt = context.get_user_data_triplet()

server_session = SRPServerSession(SRPContext(username, prime=context.prime, generator=context.generator), password_verifier)
client_session = SRPClientSession(SRPContext('alice', 'password123', prime=context.prime, generator=context.generator))
client_session.process(server_session.public, salt)
server_session.process(client_session.public, salt)
assert server_session.key == client_session.key

CLI usage requires the click package to be installed separately; API usage has no external dependencies.

Verify before relying

• Whether the package's Python 2.7 and 3.5-3.7 support claims remain accurate for modern environments.
• Current security audit status or any known cryptographic implementation concerns beyond OSV records.

Package facts

Evidence: srptools-1.0.1-py2.py3-none-any.whl

Tags

More Cryptography packages