def create_challenge(self, username, version=0):
        if len(username) > 64:
            raise ValueError("Username is too long: " + username)

        try:
            key = self.key_provider.get_key(username)
            fingerprint = key.fingerprint()
        except exceptions.NoSuchUserException:
            log.info("No public key found for '%s', faking it." % username)
            fingerprint = self._hmac(username)[:6]

        if version < 1:
            if self.lowest_supported_version > version:
                raise exceptions.ProtocolVersionError(
                    "Client needs to support at least version %d"
                    % self.lowest_supported_version
                )

            c = protocol.Challenge(fingerprint=fingerprint,
                                   server_name=self.server_name,
                                   unique_data=self.urandom.read(20),
                                   valid_from=int(self.now_func() - CLOCK_FUDGE),
                                   valid_to=int(self.now_func() + RESP_TIMEOUT),
                                   username=username)
            b = c.serialize()

            payload = protocol.VerifiablePayload(digest=self._hmac(b), payload=b)
            return ssh.base64url_encode(payload.serialize())
        else:
            c = msgpack_protocol.Challenge(
                fingerprint=fingerprint,
                server_name=self.server_name,
                unique_data=self.urandom.read(20),
                valid_from=int(self.now_func() - CLOCK_FUDGE),
                valid_to=int(self.now_func() + RESP_TIMEOUT),
                username=username)
            return ssh.base64url_encode(c.serialize(self.secret))
This method returns a challenge suitable for ssh-agent signing.
dataset/ETHPy150Open spotify/crtauth/crtauth/server.py/AuthServer.create_challenge