API Reference
cott
OPTIGA™ Authenticate NBT Cryptographic One-Time Token utilities.
- class cott.COTT(header: bytes, uid: UID7 | bytes, random: bytes, mac: MAC | bytes)
Cryptographic One-time Token abstraction.
- assemble() bytes
Assembles COTT data to binary representation (without Base64 encoding).
- Returns:
Assembled COTT data.
- See:
- classmethod decode(encoded: bytes | str) COTT
Decodes Base64 encoded COTT data to
COTTobject.COTT data is only checked for syntax, to verify COTT was created by a trusted device, use
COTT.verify().- Parameters:
encoded – Base64 encoded COTT data to be decoded.
- Returns:
Decoded COTT object.
- Raises:
ValueError – If COTT data syntactically invalid.
- classmethod dissemble(assembled: bytes) COTT
Dissembles binary COTT data (NOT Base64 encoded) to
COTTobject.COTT data is only checked for syntax, to verify COTT was created by a trusted device, use
COTT.verify().- Parameters:
assembled – Binary COTT data to be dissembled (NOT Base64 encoded).
- Returns:
Dissembled COTT object.
- Raises:
ValueError – If COTT data syntactically invalid.
- See:
- encode() bytes
Encodes COTT data to Base64 encoded binary representation.
- Returns:
Encoded COTT data.
- property header: bytes
2 byte header (b”” for the first generation T4Tplus applet).
- property random: bytes
8 byte random data.
- verify(key: Key | bytes) bool
Verifies COTT by checking that its MAC was created using the given key.
To handle mapping from UID to matching AES key, use
IKeyStore.Does not check if COTT has been used before, but this can be checked via
ICache.- Parameters:
key – AES key to be used for MAC verification.
- Returns:
True if COTT’s MAC was created using given key, otherwise False.
- class cott.ICache(*args, **kwargs)
Interface for a
COTTcache, storing previously used COTT to prevent replay attacks.
- class cott.IKeyStore(*args, **kwargs)
Interface for a key store mapping
UID7to AES keys.
- class cott.UID7(value: bytes)
Custom parameter validator for 7 byte NFC UID.
- class cott.MAC(value: bytes)
Custom parameter validator for a 16 byte AES CMAC.
- class cott.Key(value: bytes)
Custom parameter validator for an AES key.
Currently only 128-bit keys supported.
cott.server
Example implementation of a cryptographic one-time token server.
Builds on flask.Flask to showcase how to implement backend service validating COTT data.
- cott.server.create_app(keystore: IKeyStore | None = None, cache: ICache | None = None, debug: bool | None = None) Flask
Factory method creating main flask application providing COTT server API.
- Parameters:
keystore – Optional
cott.IKeyStoreto be used. By default newcott.server.keystore.KeyStorewill be used.cache – Optional
cott.ICacheto be used. By default newcott.server.cache.Cachewill be used.debug – Optional flag to enable debug mode, disabling CORS checks for local test server. If None given,
app.debugwill be used
Example implementation of cott.ICache.
Can be extended to support real implementation by previously used COTT values in a persistent database.
- class cott.server.cache.Cache
Simple memory-based implementation of
cott.ICachecaching COTTs used since server started.In real implementation, this should be stored persistently in a secured database.
Example implementation of cott.IKeyStore.
Can be extended to support real implementation by storing device specific AES keys in a secured database.
- class cott.server.keystore.KeyStore
Simple implementation of
cott.IKeyStoreproviding default AES keys for OPTIGA™ Authenticate NBT Development Kits/ShieldsIn real implementation, the AES keys should be stored on a per-device basis in a secured database.