SrpProtocol(Enum) question

[gcobb321]

Tim,
I am updating the SrpPassword class in srp_password.py in iCloud3 to your latest version and have found that the password_digest variable is always set to None after the self.protocol comparison tests

For reference, lines 38-43 are:

        password_digest: bytes | None = None

        if self.protocol == SrpProtocolType.S2K_FO:
            password_digest = self._password_hash.hex().encode()
        elif self.protocol == SrpProtocolType.S2K:
            password_digest = self._password_hash

        if password_digest is None:
            raise ValueError("Unsupported SrpPassword type")

The values of the variables are:

if self.protocol == SrpProtocolType.S2K_FO:
...
if self.protocol == SrpProtocolType.S2K:
...

self.protocol='s2k' 
SrpProtocolType.S2K_FO=<SrpProtocolType.S2K_FO: 's2k_fo'> 
SrpProtocolType.S2K=<SrpProtocolType.S2K: 's2k'>
password_digest is None

Adding .value to the SrpPassword.xxx results in the correct password_digest result

if self.protocol == SrpProtocolType.S2K_FO.value:
...
if self.protocol == SrpProtocolType.S2K.value:
...

self.protocol='s2k' 
SrpProtocolType.S2K_FO.value='s2k_fo' 
SrpProtocolType.S2K.value='s2k' 
password_digest = 's2k'

This works correctly if the SrpProtocol class is not used and the S2K_FO and S2K are set as constants in the srp_password.py module.

Am I doing something wrong? Or should this be looked at?

@gcobb321

[timlaing]

I'll take a look at it for you. Give me a couple of days if you can as I have to get a couple of other things done before I can get back to this

[timlaing]

@gcobb321

The key thing here is the construction of the SrpProtocolType. in base.py. L366

protocol: SrpProtocolType = SrpProtocolType(body["protocol"])

This takes the "s2k" or "s2k_fo" string from the response and converts it to the enum value. If the protocol value is not in the enum, a ValueError will be raised.

In the SrpPassword.encode function this is a check against the validated type and not the string value. By doing a test against SrpProtocolType.S2K.value this is a string comparison and not a enum validation.

Hope this makes sense.

@timlaing

[gcobb321]

It does make sense. I have not used the enum function and was concerned that an error may have slipped through the cracks. Glad all is OK. I have released a new version of iCloud3 with the 'value' check and will correct that on the next update.

I also did not review the base.py module where that code resides. I have been using a highly modded picklepete pyicloud from 6+ years ago and hope to port your code into iCloud3 at some point in time when I have nothing else to do.

Not sure if you are tracking Apple devices in HA. iCloud3 is on HACS. Docs are here

Thanks, Gary

[timlaing]

I used iCloud3 for a short while great project.

I think you can now get most of the information you need from this library, definitely worth checking it out and seeing if we can pool our efforts/experience.

[gcobb321]

I think I can reimplement pyiCloud too. When I started, it was old and stale and had a few issues. Really glad you took it over and are running with it. Im glad to participate and help any way I can.

I do have a logging module that logs the traffic to and from Apple that I had to develop to figure out what was going on. It includes filtering the raw data and dumping it to a file. I recently ported it to the iCloud HA integration and one of your pyiCloud versions for doing initial Fido2 support to see how that integration was handling some items.

A sample of the traffic is below. It looks better in vscode with some color filters. This has the standard filters applied. It can also show unfiltered data with everything going both ways. Let me know if there is any interest. A couple of hooks in base.py before and after the requests would do it.

12-03 17:54:07 [icloud_session:217/_request] [icloud_session:217,181; io:35; apple_acct:882,858,794,566,525] 
⠂ 🔺 GCO**1**21@, POST, REQUEST-['SIGNIN', 'INIT'] [icloud_session: 217/_request]
⠂  ❗ _.headers={'Accept': 'applic……script', 'X-Apple-OAuth-State': 'auth-0……4e40a8'}
⠂  ❗ _.json={'a': 'Fp79HJ……KePw==', 'protocols': ['s2k', 's2k_fo'], 'accountName': 'gco**1**21@'}
⠂  ❗ _.items={'url': 'idmsa.apple.com/appleauth/auth/signin/init', 'retry': 0, 'params': None, 'retried': None, 'retry_cnt': 0}
12-03 17:54:08 [icloud_session:317/_request] [icloud_session:317,181; io:35; apple_acct:882,858,794,566,525] 
⠂ 🔻 GCO**1**21@, POST, RESPONSE-['SIGNIN', 'INIT'] [icloud_session: 317/_request]
⠂  ❗ _.items={'code': 200, 'ok': True}
⠂  ❗ data.items={'iteration': 20485, 'salt': 'B8OLYs……8Xjg==', 'protocol': 's2k', 'b': 'Zkrs+x……hssw==', 'c': 'd-1ab-……74:MSA'}
12-03 17:54:08 [icloud_sessi:0333]  Saved cookies data to file /config/.storage/icloud3.apple_acct/gco**1**21@gmailcom.cookies
12-03 17:54:08 [apple_acct……:0822]  gco**1**21@, Authenticating with PasswordSRP, signin/complete, Server will verify Credentials
12-03 17:54:08 [icloud_session:217/_request] [icloud_session:217,181; io:35; apple_acct:882,871,841,566,525] 
⠂ 🔺 GCO**1**21@, POST, REQUEST-['SIGNIN', 'COMPLETE'] [icloud_session: 217/_request]
⠂  ❗ _.headers={'Accept': 'applic……script', 'X-Apple-OAuth-State': 'auth-0……4e40a8', 'X-Apple-ID-Session-Id': 'A1E873……81E9A2'}
⠂  ❗ _.json={'c': 'd-1ab-……74:MSA', 'm1': 'gY8+hP……kzrAo=', 'm2': 'OoH+U1……YiXp0=', 'trustTokens': [], 'accountName': 'gco**1**21@'}
⠂  ❗ _.items={'url': 'idmsa.apple.com/appleauth/auth/signin/complete', 'retry': 0, 'params': None, 'retried': None, 'retry_cnt': 0}
12-03 17:54:08 [icloud_session:317/_request] [icloud_session:317,181; io:35; apple_acct:882,871,841,566,525] 
⠂ 🔻 GCO**1**21@, POST, RESPONSE-['SIGNIN', 'COMPLETE'] [icloud_session: 317/_request]
⠂  ❗ _.items={'code': 409, 'ok': False}
12-03 17:54:08 [icloud_sessi:0333]  Saved cookies data to file /config/.storage/icloud3.apple_acct/gco**1**21@gmailcom.cookies
12-03 17:54:08 [apple_acct……:0625]  gco**1**21@, Authenticate with TrustToken
12-03 17:54:08 [icloud_session:217/_request] [icloud_session:217,181; io:35; apple_acct:653,644,572,525] 
⠂ 🔺 GCO**1**21@, POST, REQUEST-['1', 'ACCOUNTLOGIN'] [icloud_session: 217/_request]
⠂  ❗ _.params={'dsid': '186297810'}
⠂  ❗ _.items={'url': 'setup.icloud.com/setup/ws/1/accountLogin', 'retry': 0, 'headers': None, 'json': None, 'retried': None, 'retry_cnt': 0}
⠂  ❗ data.items={'accountCountryCode': 'USA', 'dsWebAuthToken': 'b5L4AC……wOO86S', 'extended_login': True, 'trustToken': ''}
12-03 17:54:11 [icloud_session:317/_request] [icloud_session:317,181; io:35; apple_acct:653,644,572,525] 
⠂ 🔻 GCO**1**21@, POST, RESPONSE-['1', 'ACCOUNTLOGIN'] [icloud_session: 317/_request]
⠂  ❗ _.items={'code': 200, 'ok': True}
⠂  ❗ data.dsInfo={'hsaEnabled': True, 'locked': False, 'appleId': 'gco**1**21@', 'firstName': 'Gary', 'statusCode': 2, 'lastName': 'Cobb', 'dsid': '186297810', 'locale': 'en-us_US', 'hsaVersion': 2, 'countryCode': 'USA', 'appleIdEntries': [{'isPrimary': True, 'type': 'EMAIL', 'value': 'gco**1**21@'}], 'fullName': 'Gary Cobb', 'familyEligible': True}
⠂  ❗ data.webservices.findme={'url': 'https://p123-fmipweb.icloud.com:443', 'status': 'active'}
⠂  ❗ data.items={'hsaTrustedBrowser': False, 'version': 2, 'hsaChallengeRequired': False}
12-03 17:54:11 [icloud_sessi:0333]  Saved cookies data to file /config/.storage/icloud3.apple_acct/gco**1**21@gmailcom.cookies
12-03 17:54:11 [apple_acct……:0574]  gco**1**21@, Password/TrustToken, login_successful=True
12-03 17:54:11 [apple_acct……:1238]  gco**1**21@, NEEDS-2FA, ChallengeRequired-False, TrustedBrowser-False
12-03 17:54:11 [icloud_cooki:0078] 
⠂  ❗ _.Cookie.dslang, Expires-0000-00-00 00:00:00, US-EN
⠂  ❗ _.Cookie.site, Expires-0000-00-00 00:00:00, USA
⠂  ❗ _.Cookie.acn01, Expires-2026-12-03 17:54:08, f4Jctv……CvWA==
⠂  ❗ _.Cookie.aasp, Expires-0000-00-00 00:00:00, A1E873……81E9A2
⠂  ❗ _.Cookie.DES5011651492fe26c59fdec0bc4dd700f96, Expires-2026-01-02 12:55:59, HSARMT……A=SRVX
⠂  ❗ _.Cookie.X-APPLE-UNIQUE-CLIENT-ID, Expires-0000-00-00 00:00:00, "AQ=="
⠂  ❗ _.Cookie.X-APPLE-WEBAUTH-LOGIN, Expires-0000-00-00 00:00:00, "v=1:t……lbQ~~"
⠂  ❗ _.Cookie.X-APPLE-WEBAUTH-VALIDATE, Expires-0000-00-00 00:00:00, "v=1:t……Szw~~"
⠂  ❗ _.Cookie.X-APPLE-WEBAUTH-USER, Expires-2026-01-02 17:54:11, "v=1:s……97810"
⠂  ❗ _.Cookie.X_APPLE_WEB_KB-ZVIYB7XSYWHCILBCU-0W1IAOZD4, Expires-2026-02-01 17:26:57, "v=1:t……pew~~"
⠂  ❗ _.Cookie.X-APPLE-DS-WEB-SESSION-TOKEN, Expires-2026-01-02 17:54:11, "AQEPi……iKaev"
⠂  ❗ _.Cookie.X-APPLE-WEBAUTH-HSA-TRUST, Expires-2026-03-03 17:47:24, "e5c37……=SRVX"
⠂  ❗ _.Cookie.X-APPLE-WEBAUTH-PCS-Events, Expires-2026-01-02 17:54:11, "S2V5Q……JNw=="
⠂  ❗ _.Cookie.X-APPLE-WEBAUTH-PCS-Documents, Expires-2026-01-02 17:54:11, "S2V5Q……jCQ=="
⠂  ❗ _.Cookie.X-APPLE-WEBAUTH-PCS-Photos, Expires-2026-01-02 17:54:11, "S2V5Q……ZKA=="
⠂  ❗ _.Cookie.X-APPLE-WEBAUTH-PCS-Cloudkit, Expires-2026-01-02 17:54:11, "S2V5Q……Z5g=="
⠂  ❗ _.Cookie.X-APPLE-WEBAUTH-PCS-Safari, Expires-2026-01-02 17:54:11, "S2V5Q……ORw=="
⠂  ❗ _.Cookie.X-APPLE-WEBAUTH-PCS-Mail, Expires-2026-01-02 17:54:11, "S2V5Q……eWw=="
⠂  ❗ _.Cookie.X-APPLE-WEBAUTH-PCS-Notes, Expires-2026-01-02 17:54:11, "S2V5Q……kVw=="
⠂  ❗ _.Cookie.X-APPLE-WEBAUTH-PCS-News, Expires-2026-01-02 17:54:11, "S2V5Q……UTg=="
⠂  ❗ _.Cookie.X-APPLE-WEBAUTH-PCS-Sharing, Expires-2026-01-02 17:54:11, "S2V5Q……9Dw=="
⠂  ❗ _.Cookie.X-APPLE-WEBAUTH-TOKEN, Expires-2026-01-02 17:54:11, "v=2:t……ahg~~"
⠂  ❗ _.Cookie.X-APPLE-WEBAUTH-FMIP, Expires-0000-00-00 00:00:00, "AQ==B……-IQ~~"
⠂  ❗ _.Cookie.xr_3n2093n1a, Expires-0000-00-00 00:00:00, FAIDRo……KWCr4=
12-03 17:54:11 [apple_acct……:0607]  Apple Acct Password Auth > GaryCobb, #1 (Never), 
⠂                                     • Apple Time-Dec 03, 2025, 14:54 PST
12-03 17:54:11 [apple_acct……:0611]  Apple Acct Password Auth > GaryCobb, TokenAuth-#1 (7 mins ago), PasswordAuth-#1 (Never)
12-03 17:54:12 [apple_acct_s:0732]  Configure Apple Acct > gco**1**21@, Waiting for the 6-digit Verification Code to be entered
12-03 17:47:26 [apple_acct_d:0171]  Apple Acct > gco**1**21@, RefreshRequestBy-None, LocateAllDev-True, AllDevices-6, LastLoc-?
12-03 17:47:26 [icloud_session:217/_request] [icloud_session:217,181; io:35; apple_acct…device:187,93; apple_acct:1376] 
⠂ 🔺 <APPLEACCTMANAGER: 17:47:23-GARYCOBB>, POST, REQUEST-['WEB', 'REFRESHCLIENT'] [icloud_session: 217/_request]
⠂  ❗ _.params={'dsid': '186297810'}
⠂  ❗ _.items={'url': 'p123-fmipweb.icloud.com:443/fmipservice/client/web/refreshClient', 'retry': 0, 'headers': None, 'json': None, 'retried': None, 'retry_cnt': 0}
⠂  ❗ data.items={'accountCountryCode': 'USA', 'dsWebAuthToken': 'KXf/0S……iEpFY=', 'trustToken': 'HSARMT……A=SRVX', 'extended_login': True}
12-03 17:47:26 [icloud_session:317/_request] [icloud_session:317,181; io:35; apple_acct…device:187,93; apple_acct:1376] 
⠂ 🔻 <APPLEACCTMANAGER: 17:47:23-GARYCOBB>, POST, RESPONSE-['WEB', 'REFRESHCLIENT'] [icloud_session: 317/_request]
⠂  ❗ _.items={'code': 200, 'ok': True}
⠂  ❗ data.userInfo.membersInfo={'NDM0NTU2NzE3': {'accountFormatter': 0, 'firstName': 'Lillian', 'lastName': 'Cobb', 'deviceFetchStatus': 'LOADING', 'useAuthWidget': True, 'isHSA': True, 'appleId': 'lilliancobb321@'}}
⠂  ❗ data.userInfo={'lastName': 'Cobb', 'firstName': 'Gary'}
⠂  ❗ data.content.Gary-AirPods Pro={'id': 'AbrWud……f/ng==', 'modelDisplayName': 'Accessory', 'lostModeCapable': False, 'name': 'Gary-AirPods Pro', 'deviceClass': 'Accessory', 'deviceStatus': '201', 'rawDeviceModel': 'AirPods_8212', 'batteryLevel': None, 'deviceDisplayName': 'AirPod……ation)', 'prsId': None, 'batteryStatus': None, 'location': None, 'deviceModel': 'AirPods_8212-0'}
⠂  ❗ data.content.Gary-iPad={'id': 'AUW4Dj……nWRg==', 'modelDisplayName': 'iPad', 'lostModeCapable': True, 'name': 'Gary-iPad', 'deviceClass': 'iPad', 'deviceStatus': '203', 'rawDeviceModel': 'iPad16,3', 'batteryLevel': 0.0, 'deviceDisplayName': 'iPad Pro 11-inch', 'prsId': None, 'batteryStatus': 'Unknown', 'location': {'isOld': True, 'isInaccurate': False, 'altitude': 0.0, 'addresses': None, 'positionType': 'Wifi', 'secureLocation': None, 'secureLocationTs': 0, 'latitude': 27.72680243957733, 'floorLevel': 0, 'horizontalAccuracy': 3.710450269447698, 'locationType': '', 'timeStamp': 1764801108845, 'locationFinished': True, 'verticalAccuracy': 0.0, 'locationMode': None, 'longitude': -80.39057938783155}, 'deviceModel': 'iPad16_3-1-1-0'}
⠂  ❗ data.content.Gary-iPhone={'id': 'AZoXxB……3hTg==', 'modelDisplayName': 'iPhone', 'lostModeCapable': True, 'name': 'Gary-iPhone', 'deviceClass': 'iPhone', 'deviceStatus': '200', 'rawDeviceModel': 'iPhone17,2', 'batteryLevel': 0.7699999809265137, 'deviceDisplayName': 'iPhone 16 Pro Max', 'prsId': None, 'batteryStatus': 'NotCharging', 'location': {'isOld': False, 'isInaccurate': False, 'altitude': 0.0, 'addresses': None, 'positionType': 'Wifi', 'secureLocation': None, 'secureLocationTs': 0, 'latitude': 27.726802442562445, 'floorLevel': 0, 'horizontalAccuracy': 3.7289809318864826, 'locationType': '', 'timeStamp': 1764802045363, 'locationFinished': True, 'verticalAccuracy': 0.0, 'locationMode': None, 'longitude': -80.39057937676601}, 'deviceModel': 'iPhone16-1-1-0'}

[timlaing]

Yes this would be useful. If you could put together a pull request that would be great. Many thanks.