Merge branch 'master' into idea-bespoke-vectors

* master: (246 commits)
  Fixed python3 incompatibility
  Removed dependency on setuptools for version check
  don't need to move these definitions
  conditional NIDs for 0.9.8e
  x509 changes for 0.9.8e support
  more changes for 0.9.8e support, this time in the ssl.h headers
  macro switches in evp for 0.9.8e
  bind some error constants conditionally for 0.9.8e support
  BIO macro switch for 0.9.8e support
  move some nids
  conditionally bind AES_wrap/unwrap for 0.9.8e support
  Add GPG key fingerprint for lvh
  change comparison to be easier to read
  ridiculous workaround time
  whoops
  Missing imports
  Convert stuff
  Add binding for DSA_new
  Fix drop in coverage levels by removing branches
  Added check to turn of CC backend for OS X version < 10.8
  ...

Conflicts:
	docs/development/test-vectors.rst

24 files changed, 746 insertions, 182 deletions

diff --git a/docs/changelog.rst b/docs/changelog.rst
index cd289b6e..565b0521 100644
--- a/docs/changelog.rst
+++ b/docs/changelog.rst
@@ -1,27 +1 @@
-Changelog
-=========
-
-0.2 - 2014-XX-XX
-~~~~~~~~~~~~~~~~
-
-**In development**
-
-* Added :doc:`/hazmat/backends/commoncrypto`.
-* Added initial :doc:`/hazmat/bindings/commoncrypto`.
-* Removed ``register_cipher_adapter`` method from
-  :class:`~cryptography.hazmat.backends.interfaces.CipherBackend`.
-* Added support for the OpenSSL backend under Windows.
-* Improved thread-safety for the OpenSSL backend.
-* Fixed compilation on systems where OpenSSL's ``ec.h`` header is not
-  available, such as CentOS.
-* Added :class:`~cryptography.hazmat.primitives.kdf.pbkdf2.PBKDF2HMAC`.
-* Added :class:`~cryptography.hazmat.primitives.kdf.hkdf.HKDF`.
-* Added :doc:`/hazmat/backends/multibackend`.
-* Set default random for the :doc:`/hazmat/backends/openssl` to the OS random engine.
-* Added :class:`~cryptography.hazmat.primitives.ciphers.algorithms.CAST5` (CAST-128) support.
-
-0.1 - 2014-01-08
-~~~~~~~~~~~~~~~~
-
-* Initial release.
-
+.. include:: ../CHANGELOG.rst
diff --git a/docs/development/custom-vectors/cast5.rst b/docs/development/custom-vectors/cast5.rst
index 09b3bdb1..f5400270 100644
--- a/docs/development/custom-vectors/cast5.rst
+++ b/docs/development/custom-vectors/cast5.rst
@@ -1,10 +1,11 @@
 CAST5 Vector Creation
 =====================
 
-This page documents the code that was used to generate the CAST5 CBC, CFB, and
-OFB test vectors as well as the code used to verify them against another
-implementation. For CAST5 the vectors were generated using OpenSSL and verified
-with Go.
+This page documents the code that was used to generate the CAST5 CBC, CFB, OFB,
+and CTR test vectors as well as the code used to verify them against another
+implementation. For CAST5 the CBC, CFB, and OFB vectors were generated using
+OpenSSL and the CTR vectors were generated using Apple's CommonCrypto. All the
+generated vectors were verified with Go.
 
 Creation
 --------
diff --git a/docs/development/custom-vectors/cast5/generate_cast5.py b/docs/development/custom-vectors/cast5/generate_cast5.py
index c3f579e7..32ef3b43 100644
--- a/docs/development/custom-vectors/cast5/generate_cast5.py
+++ b/docs/development/custom-vectors/cast5/generate_cast5.py
@@ -1,6 +1,6 @@
 import binascii
 
-from cryptography.hazmat.backends.openssl.backend import backend
+from cryptography.hazmat.backends import default_backend
 from cryptography.hazmat.primitives.ciphers import base, algorithms, modes
 
 
@@ -8,7 +8,7 @@ def encrypt(mode, key, iv, plaintext):
     cipher = base.Cipher(
         algorithms.CAST5(binascii.unhexlify(key)),
         mode(binascii.unhexlify(iv)),
-        backend
+        default_backend()
     )
     encryptor = cipher.encryptor()
     ct = encryptor.update(binascii.unhexlify(plaintext))
@@ -57,3 +57,5 @@ ofb_path = "tests/hazmat/primitives/vectors/ciphers/AES/OFB/OFBMMT128.rsp"
 write_file(build_vectors(modes.OFB, ofb_path), "cast5-ofb.txt")
 cfb_path = "tests/hazmat/primitives/vectors/ciphers/AES/CFB/CFB128MMT128.rsp"
 write_file(build_vectors(modes.CFB, cfb_path), "cast5-cfb.txt")
+ctr_path = "tests/hazmat/primitives/vectors/ciphers/AES/CTR/aes-128-ctr.txt"
+write_file(build_vectors(modes.CTR, ctr_path), "cast5-ctr.txt")
diff --git a/docs/development/custom-vectors/cast5/verify_cast5.go b/docs/development/custom-vectors/cast5/verify_cast5.go
index 49e1023d..f735d989 100644
--- a/docs/development/custom-vectors/cast5/verify_cast5.go
+++ b/docs/development/custom-vectors/cast5/verify_cast5.go
@@ -91,6 +91,26 @@ func (o cfbVerifier) validate(count string, key, iv, plaintext, expected_ciphert
 	}
 }
 
+type ctrVerifier struct{}
+
+func (o ctrVerifier) validate(count string, key, iv, plaintext, expected_ciphertext []byte) {
+	block, err := cast5.NewCipher(key)
+	if err != nil {
+		panic(err)
+	}
+
+	ciphertext := make([]byte, len(plaintext))
+	stream := cipher.NewCTR(block, iv)
+	stream.XORKeyStream(ciphertext, plaintext)
+
+	if !bytes.Equal(ciphertext, expected_ciphertext) {
+		panic(fmt.Errorf("vector mismatch @ COUNT = %s:\n  %s != %s\n",
+			count,
+			hex.EncodeToString(expected_ciphertext),
+			hex.EncodeToString(ciphertext)))
+	}
+}
+
 func validateVectors(verifier VectorVerifier, filename string) {
 	vectors, err := os.Open(filename)
 	if err != nil {
@@ -138,4 +158,7 @@ func main() {
 	validateVectors(cbcVerifier{},
 		"tests/hazmat/primitives/vectors/ciphers/CAST5/cast5-cbc.txt")
 	fmt.Println("CBC OK.")
+	validateVectors(ctrVerifier{},
+		"tests/hazmat/primitives/vectors/ciphers/CAST5/cast5-ctr.txt")
+	fmt.Println("CTR OK.")
 }
diff --git a/docs/development/submitting-patches.rst b/docs/development/submitting-patches.rst
index 5dca3f79..1797b9c1 100644
--- a/docs/development/submitting-patches.rst
+++ b/docs/development/submitting-patches.rst
@@ -15,7 +15,10 @@ follow the directions on the :doc:`security page </security>`.
 Code
 ----
 
-When in doubt, refer to :pep:`8` for Python code.
+When in doubt, refer to :pep:`8` for Python code. You can check if your code
+meets our automated requirements by running ``flake8`` against it. If you've
+installed the development requirements this will automatically use our
+configuration. You can also run the ``tox`` job with ``tox -e pep8``.
 
 `Write comments as complete sentences.`_
 
diff --git a/docs/development/test-vectors.rst b/docs/development/test-vectors.rst
index 8b3a6460..1d768179 100644
--- a/docs/development/test-vectors.rst
+++ b/docs/development/test-vectors.rst
@@ -13,8 +13,18 @@ Sources
 Asymmetric Ciphers
 ~~~~~~~~~~~~~~~~~~
 
-* RSA PKCS1 from the RSA FTP site (ftp://ftp.rsasecurity.com/pub/pkcs/pkcs-1/
+* RSA PKCS #1 from the RSA FTP site (ftp://ftp.rsasecurity.com/pub/pkcs/pkcs-1/
   and ftp://ftp.rsa.com/pub/rsalabs/tmp/).
+* RSA FIPS 186-2 and PKCS1 v1.5 vulnerability test vectors from `NIST CAVP`_.
+* DSA test vectors from `FIPS 186-2`_ and `FIPS 186-3`_.
+* OpenSSL PEM RSA serialization vectors from the `OpenSSL example key`_ and
+  `GnuTLS key parsing tests`_.
+* OpenSSL PEM DSA serialization vectors from the `GnuTLS example keys`_.
+* PKCS #8 PEM serialization vectors from
+
+  * GnuTLS: `encpkcs8.pem`_, `enc2pkcs8.pem`_, `unencpkcs8.pem`_,
+    `pkcs12_s2k_pem.c`_.
+  * `Botan's ECC private keys`_.
 
 Hashes
 ~~~~~~
@@ -38,6 +48,7 @@ Key Derivation Functions
 
 * HKDF (SHA1, SHA256) from :rfc:`5869`.
 * PBKDF2 (HMAC-SHA1) from :rfc:`6070`.
+* scrypt from the `draft RFC`_.
 
 Recipes
 ~~~~~~~
@@ -47,7 +58,8 @@ Recipes
 Symmetric Ciphers
 ~~~~~~~~~~~~~~~~~
 
-* AES (CBC, CFB, CTR, ECB, GCM, OFB) from `NIST CAVP`_.
+* AES (CBC, CFB, ECB, GCM, OFB) from `NIST CAVP`_.
+* AES CTR from :rfc:`3686`.
 * 3DES (CBC, CFB, ECB, OFB) from `NIST CAVP`_.
 * ARC4 from :rfc:`6229`.
 * Blowfish (CBC, CFB, ECB, OFB) from `Bruce Schneier's vectors`_.
@@ -60,6 +72,13 @@ Symmetric Ciphers
 * IDEA (CBC, CFB, OFB) generated by this project.
   See: :doc:`/development/custom-vectors/idea`
 
+Two Factor Authentication
+~~~~~~~~~~~~~~~~~~~~~~~~~
+
+* HOTP from :rfc:`4226`
+* TOTP from :rfc:`6238` (Note that an `errata`_ for the test vectors in RFC
+  6238 exists)
+
 Creating Test Vectors
 ---------------------
 
@@ -94,6 +113,18 @@ header format (substituting the correct information):
 .. _`OpenSSL's test vectors`: https://github.com/openssl/openssl/blob/97cf1f6c2854a3a955fd7dd3a1f113deba00c9ef/crypto/evp/evptests.txt#L232
 .. _`RIPEMD website`: http://homes.esat.kuleuven.be/~bosselae/ripemd160.html
 .. _`Whirlpool website`: http://www.larc.usp.br/~pbarreto/WhirlpoolPage.html
+.. _`draft RFC`: https://tools.ietf.org/html/draft-josefsson-scrypt-kdf-01
 .. _`Specification repository`: https://github.com/fernet/spec
+.. _`errata`: http://www.rfc-editor.org/errata_search.php?rfc=6238
+.. _`OpenSSL example key`: http://git.openssl.org/gitweb/?p=openssl.git;a=blob;f=test/testrsa.pem;h=aad21067a8f7cb93a52a511eb9162fd83be39135;hb=66e8211c0b1347970096e04b18aa52567c325200
+.. _`GnuTLS key parsing tests`: https://gitorious.org/gnutls/gnutls/commit/f16ef39ef0303b02d7fa590a37820440c466ce8d
+.. _`encpkcs8.pem`: https://gitorious.org/gnutls/gnutls/source/f8d943b38bf74eaaa11d396112daf43cb8aa82ae:tests/pkcs8-decode/encpkcs8.pem
+.. _`enc2pkcs8.pem`: https://gitorious.org/gnutls/gnutls/source/f8d943b38bf74eaaa11d396112daf43cb8aa82ae:tests/pkcs8-decode/enc2pkcs8.pem
+.. _`unencpkcs8.pem`: https://gitorious.org/gnutls/gnutls/source/f8d943b38bf74eaaa11d396112daf43cb8aa82ae:tests/pkcs8-decode/unencpkcs8.pem
+.. _`pkcs12_s2k_pem.c`: https://gitorious.org/gnutls/gnutls/source/f8d943b38bf74eaaa11d396112daf43cb8aa82ae:tests/pkcs12_s2k_pem.c
+.. _`Botan's ECC private keys`: https://github.com/randombit/botan/tree/4917f26a2b154e841cd27c1bcecdd41d2bdeb6ce/src/tests/data/ecc
+.. _`FIPS 186-2`: http://csrc.nist.gov/groups/STM/cavp/documents/dss/186-2dsatestvectors.zip
+.. _`FIPS 186-3`: http://csrc.nist.gov/groups/STM/cavp/documents/dss/186-3dsatestvectors.zip
+.. _`GnuTLS example keys`: https://gitorious.org/gnutls/gnutls/commit/ad2061deafdd7db78fd405f9d143b0a7c579da7b
 .. _`NESSIE IDEA vectors`: https://www.cosic.esat.kuleuven.be/nessie/testvectors/bc/idea/Idea-128-64.verified.test-vectors
 .. _`NESSIE`: https://en.wikipedia.org/wiki/NESSIE
diff --git a/docs/exceptions.rst b/docs/exceptions.rst
index 1e31e31c..48c4bca8 100644
--- a/docs/exceptions.rst
+++ b/docs/exceptions.rst
@@ -10,8 +10,8 @@ Exceptions
 
 .. class:: InvalidSignature
 
-    This is raised when the verify method of a hash context's computed digest
-    does not match the expected digest.
+    This is raised when signature verification fails. This can occur with
+    HMAC or asymmetric key signature validation.
 
 
 .. class:: NotYetFinalized
@@ -25,14 +25,34 @@ Exceptions
     This is raised when additional data is added to a context after update
     has already been called.
 
+.. class:: UnsupportedCipher
 
-.. class:: UnsupportedAlgorithm
+    .. versionadded:: 0.3
 
-    This is raised when a backend doesn't support the requested algorithm (or
-    combination of algorithms).
+    This is raised when a backend doesn't support the requested cipher
+    algorithm and mode combination.
+
+.. class:: UnsupportedHash
+
+    .. versionadded:: 0.3
+
+    This is raised when a backend doesn't support the requested hash algorithm.
+
+.. class:: UnsupportedPadding
+
+    .. versionadded:: 0.3
+
+    This is raised when the requested padding is not supported by the backend.
 
 
 .. class:: InvalidKey
 
     This is raised when the verify method of a key derivation function's
     computed key does not match the expected key.
+
+
+.. class:: InvalidToken
+
+    This is raised when the verify method of a one time password function's
+    computed token does not match the expected token.
+
diff --git a/docs/faq.rst b/docs/faq.rst
new file mode 100644
index 00000000..cbbb74ad
--- /dev/null
+++ b/docs/faq.rst
@@ -0,0 +1,18 @@
+Frequently Asked Questions
+==========================
+
+How does ``cryptography`` compare to NaCl (Networking and Cryptography Library)?
+--------------------------------------------------------------------------------
+
+While ``cryptography`` and `NaCl`_ both share the goal of making cryptography
+easier, and safer, to use for developers, ``cryptography`` is designed to be a
+general purpose library, interoperable with existing systems, while NaCl
+features a collection of hand selected algorithms.
+
+``cryptography``'s :ref:`recipes <cryptography-layout>` layer has similar goals
+to NaCl.
+
+If you prefer NaCl's design, we highly recommend `PyNaCl`_.
+
+.. _`NaCl`: http://nacl.cr.yp.to/
+.. _`PyNaCl`: https://pynacl.readthedocs.org
diff --git a/docs/glossary.rst b/docs/glossary.rst
index 4421fca3..ef422a6e 100644
--- a/docs/glossary.rst
+++ b/docs/glossary.rst
@@ -26,9 +26,29 @@ Glossary
         Cryptographic operations where encryption and decryption use the same
         key.
 
+    public-key cryptography
     asymmetric cryptography
         Cryptographic operations where encryption and decryption use different
-        keys. There are separate encryption and decryption keys.
+        keys. There are separate encryption and decryption keys. Typically
+        encryption is performed using a :term:`public key`, and it can then be
+        decrypted using a :term:`private key`. Asymmetric cryptography can also
+        be used to create signatures, which can be generated with a
+        :term:`private key` and verified with a :term:`public key`.
+
+    public key
+        This is one of two keys involved in :term:`public-key cryptography`. It
+        can be used to encrypt messages for someone possessing the
+        corresponding :term:`private key` and to verify signatures created with
+        the corresponding :term:`private key`. This can be distributed
+        publicly, hence the name.
+
+    private key
+        This is one of two keys involved in :term:`public-key cryptography`. It
+        can be used to decrypt messages which were encrypted with the
+        corresponding :term:`public key`, as well as to create signatures,
+        which can be verified with the corresponding :term:`public key`. These
+        **must** be kept secret, if they are exposed, all encrypted messages
+        are compromised, and an attacker will be able to forge signatures.
 
     authentication
         The process of verifying that a message was created by a specific
diff --git a/docs/hazmat/backends/interfaces.rst b/docs/hazmat/backends/interfaces.rst
index e6bf8f69..a7a9661b 100644
--- a/docs/hazmat/backends/interfaces.rst
+++ b/docs/hazmat/backends/interfaces.rst
@@ -212,3 +212,62 @@ A specific ``backend`` may provide one or more of these interfaces.
             provider.
 
         :raises ValueError: If the public_exponent is not valid.
+
+    .. method:: create_rsa_signature_ctx(private_key, padding, algorithm)
+
+        :param private_key: An instance of an
+            :class:`~cryptography.hazmat.primitives.interfaces.RSAPrivateKey`
+            provider.
+
+        :param padding: An instance of an
+            :class:`~cryptography.hazmat.primitives.interfaces.AsymmetricPadding`
+            provider.
+
+        :param algorithm: An instance of a
+            :class:`~cryptography.hazmat.primitives.interfaces.HashAlgorithm`
+            provider.
+
+        :returns:
+            :class:`~cryptography.hazmat.primitives.interfaces.AsymmetricSignatureContext`
+
+    .. method:: create_rsa_verification_ctx(public_key, signature, padding, algorithm)
+
+        :param public_key: An instance of a
+            :class:`~cryptography.hazmat.primitives.interfaces.RSAPublicKey`
+            provider.
+
+        :param bytes signature: The signature to verify.
+
+        :param padding: An instance of an
+            :class:`~cryptography.hazmat.primitives.interfaces.AsymmetricPadding`
+            provider.
+
+        :param algorithm: An instance of a
+            :class:`~cryptography.hazmat.primitives.interfaces.HashAlgorithm`
+            provider.
+
+        :returns:
+            :class:`~cryptography.hazmat.primitives.interfaces.AsymmetricVerificationContext`
+
+
+.. class:: OpenSSLSerializationBackend
+
+    .. versionadded:: 0.3
+
+    A backend with methods for working with OpenSSL's "traditional" PKCS #1
+    style key serialization.
+
+    .. method:: load_openssl_pem_private_key(data, password)
+
+        :param bytes data: PEM data to deserialize.
+
+        :param bytes password: The password to use if this data is encrypted.
+            Should be None if the data is not encrypted.
+
+        :return: A new instance of
+            :class:`~cryptography.hazmat.primitives.serialization.OpenSSLPrivateKey`
+
+        :raises ValueError: If the data could not be deserialized correctly.
+
+        :raises cryptography.exceptions.UnsupportedAlgorithm: If the data is
+            encrypted with an unsupported algorithm.
diff --git a/docs/hazmat/primitives/asymmetric/index.rst b/docs/hazmat/primitives/asymmetric/index.rst
new file mode 100644
index 00000000..10319fad
--- /dev/null
+++ b/docs/hazmat/primitives/asymmetric/index.rst
@@ -0,0 +1,10 @@
+.. hazmat::
+
+Asymmetric Algorithms
+=====================
+
+.. toctree::
+    :maxdepth: 1
+
+    rsa
+    padding
diff --git a/docs/hazmat/primitives/asymmetric/padding.rst b/docs/hazmat/primitives/asymmetric/padding.rst
new file mode 100644
index 00000000..7aec3bd3
--- /dev/null
+++ b/docs/hazmat/primitives/asymmetric/padding.rst
@@ -0,0 +1,20 @@
+.. hazmat::
+
+Padding
+=======
+
+.. currentmodule:: cryptography.hazmat.primitives.asymmetric.padding
+
+.. warning::
+    `Padding is critical`_ when signing or encrypting data using RSA. Without
+    correct padding signatures can be forged, messages decrypted, and private
+    keys compromised.
+
+.. class:: PKCS1v15()
+
+    .. versionadded:: 0.3
+
+    PKCS1 v1.5 (also known as simply PKCS1) is a simple padding scheme
+    developed for use with RSA keys. It is defined in :rfc:`3447`.
+
+.. _`Padding is critical`: http://rdist.root.org/2009/10/06/why-rsa-encryption-padding-is-critical/
diff --git a/docs/hazmat/primitives/asymmetric/rsa.rst b/docs/hazmat/primitives/asymmetric/rsa.rst
new file mode 100644
index 00000000..7943981e
--- /dev/null
+++ b/docs/hazmat/primitives/asymmetric/rsa.rst
@@ -0,0 +1,160 @@
+.. hazmat::
+
+RSA
+===
+
+.. currentmodule:: cryptography.hazmat.primitives.asymmetric.rsa
+
+`RSA`_ is a `public-key`_ algorithm for encrypting and signing messages.
+
+.. class:: RSAPrivateKey(p, q, private_exponent, dmp1, dmq1, iqmp, public_exponent, modulus)
+
+    .. versionadded:: 0.2
+
+    An RSA private key is required for decryption and signing of messages.
+
+    You should use :meth:`~generate` to generate new keys.
+
+    .. warning::
+        This method only checks a limited set of properties of its arguments.
+        Using an RSA private key that you do not trust or with incorrect
+        parameters may lead to insecure operation, crashes, and other undefined
+        behavior. We recommend that you only ever load private keys that were
+        generated with software you trust.
+
+
+    This class conforms to the
+    :class:`~cryptography.hazmat.primitives.interfaces.RSAPrivateKey`
+    interface.
+
+    :raises TypeError: This is raised when the arguments are not all integers.
+
+    :raises ValueError: This is raised when the values of ``p``, ``q``,
+                        ``private_exponent``, ``public_exponent``, or
+                        ``modulus`` do not match the bounds specified in
+                        :rfc:`3447`.
+
+    .. classmethod:: generate(public_exponent, key_size, backend)
+
+        Generate a new ``RSAPrivateKey`` instance using ``backend``.
+
+        :param int public_exponent: The public exponent of the new key.
+            Usually one of the small Fermat primes 3, 5, 17, 257, 65537. If in
+            doubt you should `use 65537`_.
+        :param int key_size: The length of the modulus in bits. For keys
+            generated in 2014 this should be `at least 2048`_. (See page 41.)
+            Must be at least 512. Some backends may have additional
+            limitations.
+        :param backend: A
+            :class:`~cryptography.hazmat.backends.interfaces.RSABackend`
+            provider.
+        :return: A new instance of ``RSAPrivateKey``.
+
+    .. method:: signer(padding, algorithm, backend)
+
+        .. versionadded:: 0.3
+
+        Sign data which can be verified later by others using the public key.
+
+        .. doctest::
+
+            >>> from cryptography.hazmat.backends import default_backend
+            >>> from cryptography.hazmat.primitives import hashes
+            >>> from cryptography.hazmat.primitives.asymmetric import rsa, padding
+            >>> private_key = rsa.RSAPrivateKey.generate(
+            ...     public_exponent=65537,
+            ...     key_size=2048,
+            ...     backend=default_backend()
+            ... )
+            >>> signer = private_key.signer(
+            ...     padding.PKCS1v15(),
+            ...     hashes.SHA256(),
+            ...     default_backend()
+            ... )
+            >>> signer.update(b"this is some data I'd like")
+            >>> signer.update(b" to sign")
+            >>> signature = signer.finalize()
+
+        :param padding: An instance of a
+            :class:`~cryptography.hazmat.primitives.interfaces.AsymmetricPadding`
+            provider.
+
+        :param algorithm: An instance of a
+            :class:`~cryptography.hazmat.primitives.interfaces.HashAlgorithm`
+            provider.
+
+        :param backend: A
+            :class:`~cryptography.hazmat.backends.interfaces.RSABackend`
+            provider.
+
+        :returns:
+            :class:`~cryptography.hazmat.primitives.interfaces.AsymmetricSignatureContext`
+
+
+.. class:: RSAPublicKey(public_exponent, modulus)
+
+    .. versionadded:: 0.2
+
+    An RSA public key is required for encryption and verification of messages.
+
+    Normally you do not need to directly construct public keys because you'll
+    be loading them from a file, generating them automatically or receiving
+    them from a 3rd party.
+
+    This class conforms to the
+    :class:`~cryptography.hazmat.primitives.interfaces.RSAPublicKey`
+    interface.
+
+    :raises TypeError: This is raised when the arguments are not all integers.
+
+    :raises ValueError: This is raised when the values of ``public_exponent``
+                        or ``modulus`` do not match the bounds specified in
+                        :rfc:`3447`.
+
+    .. method:: verifier(signature, padding, algorithm, backend)
+
+        .. versionadded:: 0.3
+
+        Verify data was signed by the private key associated with this public
+        key.
+
+        .. doctest::
+
+            >>> from cryptography.hazmat.backends import default_backend
+            >>> from cryptography.hazmat.primitives import hashes
+            >>> from cryptography.hazmat.primitives.asymmetric import rsa, padding
+            >>> private_key = rsa.RSAPrivateKey.generate(
+            ...     public_exponent=65537,
+            ...     key_size=2048,
+            ...     backend=default_backend()
+            ... )
+            >>> signer = private_key.signer(padding.PKCS1v15(), hashes.SHA256(), default_backend())
+            >>> data= b"this is some data I'd like to sign"
+            >>> signer.update(data)
+            >>> signature = signer.finalize()
+            >>> public_key = private_key.public_key()
+            >>> verifier = public_key.verifier(signature, padding.PKCS1v15(), hashes.SHA256(), default_backend())
+            >>> verifier.update(data)
+            >>> verifier.verify()
+
+        :param bytes signature: The signature to verify.
+
+        :param padding: An instance of a
+            :class:`~cryptography.hazmat.primitives.interfaces.AsymmetricPadding`
+            provider.
+
+        :param algorithm: An instance of a
+            :class:`~cryptography.hazmat.primitives.interfaces.HashAlgorithm`
+            provider.
+
+        :param backend: A
+            :class:`~cryptography.hazmat.backends.interfaces.RSABackend`
+            provider.
+
+        :returns:
+            :class:`~cryptography.hazmat.primitives.interfaces.AsymmetricVerificationContext`
+
+.. _`RSA`: https://en.wikipedia.org/wiki/RSA_(cryptosystem)
+.. _`public-key`: https://en.wikipedia.org/wiki/Public-key_cryptography
+.. _`use 65537`: http://www.daemonology.net/blog/2009-06-11-cryptographic-right-answers.html
+.. _`at least 2048`: http://www.ecrypt.eu.org/documents/D.SPA.20.pdf
diff --git a/docs/hazmat/primitives/cryptographic-hashes.rst b/docs/hazmat/primitives/cryptographic-hashes.rst
index 6c56acad..86b85852 100644
--- a/docs/hazmat/primitives/cryptographic-hashes.rst
+++ b/docs/hazmat/primitives/cryptographic-hashes.rst
@@ -29,7 +29,7 @@ Message Digests
         'l\xa1=R\xcap\xc8\x83\xe0\xf0\xbb\x10\x1eBZ\x89\xe8bM\xe5\x1d\xb2\xd29%\x93\xafj\x84\x11\x80\x90'
 
     If the backend doesn't support the requested ``algorithm`` an
-    :class:`~cryptography.exceptions.UnsupportedAlgorithm` will be raised.
+    :class:`~cryptography.exceptions.UnsupportedHash` will be raised.
 
     Keep in mind that attacks against cryptographic hashes only get stronger
     with time, and that often algorithms that were once thought to be strong,
diff --git a/docs/hazmat/primitives/hmac.rst b/docs/hazmat/primitives/hmac.rst
index 0118be78..1a2838f7 100644
--- a/docs/hazmat/primitives/hmac.rst
+++ b/docs/hazmat/primitives/hmac.rst
@@ -35,7 +35,7 @@ message.
         '#F\xdaI\x8b"e\xc4\xf1\xbb\x9a\x8fc\xff\xf5\xdex.\xbc\xcd/+\x8a\x86\x1d\x84\'\xc3\xa6\x1d\xd8J'
 
     If the backend doesn't support the requested ``algorithm`` an
-    :class:`~cryptography.exceptions.UnsupportedAlgorithm` will be raised.
+    :class:`~cryptography.exceptions.UnsupportedHash` will be raised.
 
     To check that a given signature is correct use the :meth:`verify` method.
     You will receive an exception if the signature is wrong:
diff --git a/docs/hazmat/primitives/index.rst b/docs/hazmat/primitives/index.rst
index 38ed24c9..90deec8b 100644
--- a/docs/hazmat/primitives/index.rst
+++ b/docs/hazmat/primitives/index.rst
@@ -11,6 +11,7 @@ Primitives
     symmetric-encryption
     padding
     key-derivation-functions
-    rsa
+    asymmetric/index
     constant-time
     interfaces
+    twofactor
diff --git a/docs/hazmat/primitives/interfaces.rst b/docs/hazmat/primitives/interfaces.rst
index df17e59d..cc2a3000 100644
--- a/docs/hazmat/primitives/interfaces.rst
+++ b/docs/hazmat/primitives/interfaces.rst
@@ -231,6 +231,146 @@ Asymmetric Interfaces
         The public exponent. Alias for :attr:`public_exponent`.
 
 
+.. class:: DSAParameters
+
+    .. versionadded:: 0.3
+
+    `DSA`_ parameters.
+
+    .. attribute:: modulus
+
+        :type: int
+
+        The prime modulus that is used in generating the DSA key pair and used
+        in the DSA signing and verification processes.
+
+    .. attribute:: subgroup_order
+
+        :type: int
+
+        The subgroup order that is used in generating the DSA key pair
+        by the generator and used in the DSA signing and verification
+        processes.
+
+    .. attribute:: generator
+
+        :type: int
+
+        The generator that is used in generating the DSA key pair and used
+        in the DSA signing and verification processes.
+
+    .. attribute:: p
+
+        :type: int
+
+        The prime modulus that is used in generating the DSA key pair and used
+        in the DSA signing and verification processes. Alias for :attr:`modulus`.
+
+    .. attribute:: q
+
+        :type: int
+
+        The subgroup order that is used in generating the DSA key pair
+        by the generator and used in the DSA signing and verification
+        processes. Alias for :attr:`subgroup_order`.
+
+    .. attribute:: g
+
+        :type: int
+
+        The generator that is used in generating the DSA key pair and used
+        in the DSA signing and verification processes. Alias for :attr:`generator`.
+
+
+.. class:: DSAPrivateKey
+
+    .. versionadded:: 0.3
+
+    A `DSA`_ private key.
+
+    .. method:: public_key()
+
+        :return: :class:`~cryptography.hazmat.primitives.interfaces.DSAPublicKey`
+
+        An DSA public key object corresponding to the values of the private key.
+
+    .. method:: parameters()
+
+        :return: :class:`~cryptography.hazmat.primitives.interfaces.DSAParameters`
+
+        The DSAParameters object associated with this private key.
+
+    .. attribute:: key_size
+
+        :type: int
+
+        The bit length of the modulus.
+
+    .. attribute:: x
+
+        :type: int
+
+        The private key.
+
+    .. attribute:: y
+
+        :type: int
+
+        The public key.
+
+
+.. class:: DSAPublicKey
+
+    .. versionadded:: 0.3
+
+    A `DSA`_ private key.
+
+    .. method:: parameters()
+
+        :return: :class:`~cryptography.hazmat.primitives.interfaces.DSAParameters`
+
+        The DSAParameters object associated with this public key.
+
+    .. attribute:: y
+
+        :type: int
+
+        The public key.
+
+
+.. class:: AsymmetricSignatureContext
+
+    .. versionadded:: 0.2
+
+    .. method:: update(data)
+
+        :param bytes data: The data you want to sign.
+
+    .. method:: finalize()
+
+        :return bytes signature: The signature.
+
+
+.. class:: AsymmetricVerificationContext
+
+    .. versionadded:: 0.2
+
+    .. method:: update(data)
+
+        :param bytes data: The data you wish to verify using the signature.
+
+    .. method:: verify()
+
+        :raises cryptography.exceptions.InvalidSignature: If the signature does
+            not validate.
+
+
+.. class:: AsymmetricPadding
+
+    .. versionadded:: 0.2
+
+    .. attribute:: name
+
 Hash Algorithms
 ~~~~~~~~~~~~~~~
 
@@ -302,3 +442,4 @@ Key Derivation Functions
 
 .. _`RSA`: https://en.wikipedia.org/wiki/RSA_(cryptosystem)
 .. _`Chinese remainder theorem`: https://en.wikipedia.org/wiki/Chinese_remainder_theorem
+.. _`DSA`: https://en.wikipedia.org/wiki/Digital_Signature_Algorithm
diff --git a/docs/hazmat/primitives/key-derivation-functions.rst b/docs/hazmat/primitives/key-derivation-functions.rst
index d8a0e241..851dbb0b 100644
--- a/docs/hazmat/primitives/key-derivation-functions.rst
+++ b/docs/hazmat/primitives/key-derivation-functions.rst
@@ -179,7 +179,7 @@ Different KDFs are suitable for different tasks such as:
     :param bytes info: Application specific context information.  If ``None``
         is explicitly passed an empty byte string will be used.
 
-    :params backend: A
+    :param backend: A
         :class:`~cryptography.hazmat.backends.interfaces.HMACBackend`
         provider.
 
diff --git a/docs/hazmat/primitives/rsa.rst b/docs/hazmat/primitives/rsa.rst
deleted file mode 100644
index e7ec4749..00000000
--- a/docs/hazmat/primitives/rsa.rst
+++ /dev/null
@@ -1,79 +0,0 @@
-.. hazmat::
-
-RSA
-===
-
-.. currentmodule:: cryptography.hazmat.primitives.asymmetric.rsa
-
-`RSA`_ is a `public-key`_ algorithm for encrypting and signing messages.
-
-.. class:: RSAPrivateKey(p, q, private_exponent, dmp1, dmq1, iqmp,
-                         public_exponent, modulus)
-
-    .. versionadded:: 0.2
-
-    An RSA private key is required for decryption and signing of messages.
-
-    You should use
-    :meth:`~cryptography.hazmat.primitives.asymmetric.rsa.RSAPrivateKey.generate`
-    to generate new keys.
-
-    .. warning::
-        This method only checks a limited set of properties of its arguments.
-        Using an RSA private key that you do not trust or with incorrect
-        parameters may lead to insecure operation, crashes, and other undefined
-        behavior. We recommend that you only ever load private keys that were
-        generated with software you trust.
-
-
-    This class conforms to the
-    :class:`~cryptography.hazmat.primitives.interfaces.RSAPrivateKey`
-    interface.
-
-    :raises TypeError: This is raised when the arguments are not all integers.
-
-    :raises ValueError: This is raised when the values of ``p``, ``q``,
-                        ``private_exponent``, ``public_exponent``, or
-                        ``modulus`` do not match the bounds specified in
-                        :rfc:`3447`.
-
-    .. classmethod:: generate(public_exponent, key_size, backend)
-
-        Generate a new ``RSAPrivateKey`` instance using ``backend``.
-
-        :param int public_exponent: The public exponent of the new key.
-            Usually one of the small Fermat primes 3, 5, 17, 257, 65537. If in
-            doubt you should `use 65537`_.
-        :param int key_size: The length of the modulus in bits. For keys
-            generated in 2014 this should be `at least 2048`_. (See page 41.)
-            Must be at least 512. Some backends may have additional
-            limitations.
-        :param backend: A
-            :class:`~cryptography.hazmat.backends.interfaces.RSABackend`
-            provider.
-        :return: A new instance of ``RSAPrivateKey``.
-
-.. class:: RSAPublicKey(public_exponent, modulus)
-
-    .. versionadded:: 0.2
-
-    An RSA public key is required for encryption and verification of messages.
-
-    Normally you do not need to directly construct public keys because you'll
-    be loading them from a file, generating them automatically or receiving
-    them from a 3rd party.
-
-    This class conforms to the
-    :class:`~cryptography.hazmat.primitives.interfaces.RSAPublicKey`
-    interface.
-
-    :raises TypeError: This is raised when the arguments are not all integers.
-
-    :raises ValueError: This is raised when the values of ``public_exponent``
-                        or ``modulus`` do not match the bounds specified in
-                        :rfc:`3447`.
-
-.. _`RSA`: https://en.wikipedia.org/wiki/RSA_(cryptosystem)
-.. _`public-key`: https://en.wikipedia.org/wiki/Public-key_cryptography
-.. _`use 65537`: http://www.daemonology.net/blog/2009-06-11-cryptographic-right-answers.html
-.. _`at least 2048`: http://www.ecrypt.eu.org/documents/D.SPA.20.pdf
diff --git a/docs/hazmat/primitives/symmetric-encryption.rst b/docs/hazmat/primitives/symmetric-encryption.rst
index d91dde9d..2bc25c50 100644
--- a/docs/hazmat/primitives/symmetric-encryption.rst
+++ b/docs/hazmat/primitives/symmetric-encryption.rst
@@ -61,7 +61,7 @@ an "encrypt-then-MAC" formulation as `described by Colin Percival`_.
             provider.
 
         If the backend doesn't support the requested combination of ``cipher``
-        and ``mode`` an :class:`~cryptography.exceptions.UnsupportedAlgorithm`
+        and ``mode`` an :class:`~cryptography.exceptions.UnsupportedCipher`
         will be raised.
 
     .. method:: decryptor()
@@ -71,7 +71,7 @@ an "encrypt-then-MAC" formulation as `described by Colin Percival`_.
             provider.
 
         If the backend doesn't support the requested combination of ``cipher``
-        and ``mode`` an :class:`cryptography.exceptions.UnsupportedAlgorithm`
+        and ``mode`` an :class:`cryptography.exceptions.UnsupportedCipher`
         will be raised.
 
 .. _symmetric-encryption-algorithms:
@@ -88,7 +88,7 @@ Algorithms
     choice for encryption.
 
     :param bytes key: The secret key, either ``128``, ``192``, or ``256`` bits.
-                      This must be kept secret.
+        This must be kept secret.
 
 .. class:: Camellia(key)
 
@@ -97,7 +97,7 @@ Algorithms
     is not as widely studied or deployed.
 
     :param bytes key: The secret key, either ``128``, ``192``, or ``256`` bits.
-                      This must be kept secret.
+        This must be kept secret.
 
 .. class:: TripleDES(key)
 
@@ -108,12 +108,11 @@ Algorithms
     is incredibly slow; old applications should consider moving away from it.
 
     :param bytes key: The secret key, either ``64``, ``128``, or ``192`` bits
-                      (note that DES functionally uses ``56``, ``112``, or
-                      ``168`` bits of the key, there is a parity byte in each
-                      component of the key), in some materials these are
-                      referred to as being up to three separate keys (each
-                      ``56`` bits long), they can simply be concatenated to
-                      produce the full key. This must be kept secret.
+        (note that DES functionally uses ``56``, ``112``, or ``168`` bits of
+        the key, there is a parity byte in each component of the key), in some
+        materials these are referred to as being up to three separate keys
+        (each ``56`` bits long), they can simply be concatenated to produce the
+        full key. This must be kept secret.
 
 .. class:: CAST5(key)
 
@@ -124,7 +123,7 @@ Algorithms
     a variable key length cipher and supports keys from 40-128 bits in length.
 
     :param bytes key: The secret key, 40-128 bits in length (in increments of
-                      8).  This must be kept secret.
+        8).  This must be kept secret.
 
 Weak Ciphers
 ------------
@@ -142,7 +141,7 @@ Weak Ciphers
     that users of Blowfish move to newer algorithms, such as :class:`AES`.
 
     :param bytes key: The secret key, 32-448 bits in length (in increments of
-                      8).  This must be kept secret.
+        8).  This must be kept secret.
 
 .. class:: ARC4(key)
 
@@ -151,8 +150,7 @@ Weak Ciphers
     mode constructions.
 
     :param bytes key: The secret key, ``40``, ``56``, ``64``, ``80``, ``128``,
-                      ``192``, or ``256`` bits in length.  This must be kept
-                      secret.
+        ``192``, or ``256`` bits in length.  This must be kept secret.
 
     .. doctest::
 
@@ -182,17 +180,12 @@ Modes
     **Padding is required when using this mode.**
 
     :param bytes initialization_vector: Must be random bytes. They do not need
-                                        to be kept secret (they can be included
-                                        in a transmitted message). Must be the
-                                        same number of bytes as the
-                                        ``block_size`` of the cipher. Each time
-                                        something is encrypted a new
-                                        ``initialization_vector`` should be
-                                        generated. Do not reuse an
-                                        ``initialization_vector`` with
-                                        a given ``key``, and particularly do
-                                        not use a constant
-                                        ``initialization_vector``.
+        to be kept secret (they can be included in a transmitted message). Must
+        be the same number of bytes as the ``block_size`` of the cipher. Each
+        time something is encrypted a new ``initialization_vector`` should be
+        generated. Do not reuse an ``initialization_vector`` with a given
+        ``key``, and particularly do not use a constant
+        ``initialization_vector``.
 
     A good construction looks like:
 
@@ -226,12 +219,11 @@ Modes
     **This mode does not require padding.**
 
     :param bytes nonce: Should be random bytes. It is critical to never reuse a
-                        ``nonce`` with a given key.  Any reuse of a nonce
-                        with the same key compromises the security of every
-                        message encrypted with that key. Must be the same
-                        number of bytes as the ``block_size`` of the cipher
-                        with a given key. The nonce does not need to be kept
-                        secret and may be included alongside the ciphertext.
+        ``nonce`` with a given key.  Any reuse of a nonce with the same key
+        compromises the security of every message encrypted with that key. Must
+        be the same number of bytes as the ``block_size`` of the cipher with a
+        given key. The nonce does not need to be kept secret and may be
+        included alongside the ciphertext.
 
 .. class:: OFB(initialization_vector)
 
@@ -241,12 +233,9 @@ Modes
     **This mode does not require padding.**
 
     :param bytes initialization_vector: Must be random bytes. They do not need
-                                        to be kept secret (they can be included
-                                        in a transmitted message). Must be the
-                                        same number of bytes as the
-                                        ``block_size`` of the cipher. Do not
-                                        reuse an ``initialization_vector`` with
-                                        a given ``key``.
+        to be kept secret (they can be included in a transmitted message). Must
+        be the same number of bytes as the ``block_size`` of the cipher. Do not
+        reuse an ``initialization_vector`` with a given ``key``.
 
 .. class:: CFB(initialization_vector)
 
@@ -256,12 +245,9 @@ Modes
     **This mode does not require padding.**
 
     :param bytes initialization_vector: Must be random bytes. They do not need
-                                        to be kept secret (they can be included
-                                        in a transmitted message). Must be the
-                                        same number of bytes as the
-                                        ``block_size`` of the cipher. Do not
-                                        reuse an ``initialization_vector`` with
-                                        a given ``key``.
+        to be kept secret (they can be included in a transmitted message). Must
+        be the same number of bytes as the ``block_size`` of the cipher. Do not
+        reuse an ``initialization_vector`` with a given ``key``.
 
 .. class:: GCM(initialization_vector, tag=None)
 
@@ -282,13 +268,10 @@ Modes
     **This mode does not require padding.**
 
     :param bytes initialization_vector: Must be random bytes. They do not need
-                                        to be kept secret (they can be included
-                                        in a transmitted message). NIST
-                                        `recommends 96-bit IV length`_ for
-                                        performance critical situations, but it
-                                        can be up to 2\ :sup:`64` - 1 bits.
-                                        Do not reuse an ``initialization_vector``
-                                        with a given ``key``.
+        to be kept secret (they can be included in a transmitted message). NIST
+        `recommends 96-bit IV length`_ for performance critical situations, but
+        it can be up to 2\ :sup:`64` - 1 bits. Do not reuse an
+        ``initialization_vector`` with a given ``key``.
 
     .. note::
 
@@ -300,8 +283,8 @@ Modes
         (32-bits). Applications **must** verify the tag is the expected length
         to guarantee the expected security margin.
 
-    :param bytes tag: The tag bytes to verify during decryption. When encrypting
-                      this must be None.
+    :param bytes tag: The tag bytes to verify during decryption. When
+        encrypting this must be ``None``.
 
     .. testcode::
 
@@ -428,8 +411,7 @@ Interfaces
 
         :return bytes: Returns the remainder of the data.
         :raises ValueError: This is raised when the data provided isn't
-                            correctly padded to be a multiple of the
-                            algorithm's block size.
+            correctly padded to be a multiple of the algorithm's block size.
 
         Once ``finalize`` is called this object can no longer be used and
         :meth:`update` and :meth:`finalize` will raise
@@ -473,7 +455,7 @@ Interfaces
 
         :return bytes: Returns the tag value as bytes.
         :raises: :class:`~cryptography.exceptions.NotYetFinalized` if called
-                 before the context is finalized.
+            before the context is finalized.
 
 
 .. _`described by Colin Percival`: http://www.daemonology.net/blog/2009-06-11-cryptographic-right-answers.html
diff --git a/docs/hazmat/primitives/twofactor.rst b/docs/hazmat/primitives/twofactor.rst
new file mode 100644
index 00000000..3912d483
--- /dev/null
+++ b/docs/hazmat/primitives/twofactor.rst
@@ -0,0 +1,162 @@
+.. hazmat::
+
+Two-factor Authentication
+=========================
+
+.. currentmodule:: cryptography.hazmat.primitives.twofactor
+
+This module contains algorithms related to two-factor authentication.
+
+Currently, it contains an algorithm for generating and verifying
+one time password values based on Hash-based message authentication
+codes (HMAC).
+
+.. currentmodule:: cryptography.hazmat.primitives.twofactor.hotp
+
+.. class:: HOTP(key, length, algorithm, backend)
+
+    .. versionadded:: 0.3
+
+    HOTP objects take a ``key``, ``length`` and ``algorithm`` parameter. The
+    ``key`` should be randomly generated bytes and is recommended to be 160
+    bits in length. The ``length`` parameter controls the length of the
+    generated one time password and must be >= 6 and <= 8.
+
+    This is an implementation of :rfc:`4226`.
+
+    .. doctest::
+
+        >>> import os
+        >>> from cryptography.hazmat.backends import default_backend
+        >>> from cryptography.hazmat.primitives.twofactor.hotp import HOTP
+        >>> from cryptography.hazmat.primitives.hashes import SHA1
+        >>> key = os.urandom(16)
+        >>> hotp = HOTP(key, 6, SHA1(), backend=default_backend())
+        >>> hotp_value = hotp.generate(0)
+        >>> hotp.verify(hotp_value, 0)
+
+    :param bytes key: Per-user secret key. This value must be kept secret
+                      and be at least 128 bits. It is recommended that the
+                      key be 160 bits.
+    :param int length: Length of generated one time password as ``int``.
+    :param HashAlgorithm algorithm: A
+        :class:`~cryptography.hazmat.primitives.hashes`
+        provider.
+    :param backend: A
+        :class:`~cryptography.hazmat.backends.interfaces.HMACBackend`
+        provider.
+    :raises ValueError: This is raised if the provided ``key`` is shorter than
+        128 bits or if the ``length`` parameter is not 6, 7 or 8.
+    :raises TypeError: This is raised if the provided ``algorithm`` is not
+        :class:`~cryptography.hazmat.primitives.hashes.SHA1()`,
+        :class:`~cryptography.hazmat.primitives.hashes.SHA256()` or
+        :class:`~cryptography.hazmat.primitives.hashes.SHA512()` or if the
+        ``length`` parameter is not an integer.
+
+    .. method:: generate(counter)
+
+        :param int counter: The counter value used to generate the one time
+            password.
+        :return bytes: A one time password value.
+
+    .. method:: verify(hotp, counter)
+
+        :param bytes hotp: The one time password value to validate.
+        :param int counter: The counter value to validate against.
+        :raises cryptography.exceptions.InvalidToken: This is raised when the
+            supplied HOTP does not match the expected HOTP.
+
+Throttling
+~~~~~~~~~~
+
+Due to the fact that the HOTP algorithm generates rather short tokens that are
+6 - 8 digits long, brute force attacks are possible. It is highly recommended
+that the server that validates the token implement a throttling scheme that
+locks out the account for a period of time after a number of failed attempts.
+The number of allowed attempts should be as low as possible while still
+ensuring that usability is not significantly impacted.
+
+Re-synchronization of the Counter
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+The server's counter value should only be incremented on a successful HOTP
+authentication. However, the counter on the client is incremented every time a
+new HOTP value is requested. This can lead to the counter value being out of
+synchronization between the client and server.
+
+Due to this, it is highly recommended that the server sets a look-ahead window
+that allows the server to calculate the next ``x`` HOTP values and check them
+against the supplied HOTP value. This can be accomplished with something
+similar to the following code.
+
+.. code-block:: python
+
+    def verify(hotp, counter, look_ahead):
+        assert look_ahead >= 0
+        correct_counter = None
+
+        otp = HOTP(key, 6, default_backend())
+        for count in range(counter, counter + look_ahead):
+            try:
+                otp.verify(hotp, count)
+                correct_counter = count
+            except InvalidToken:
+                pass
+
+        return correct_counter
+
+.. currentmodule:: cryptography.hazmat.primitives.twofactor.totp
+
+.. class:: TOTP(key, length, algorithm, time_step, backend)
+
+    TOTP objects take a ``key``, ``length``, ``algorithm`` and ``time_step``
+    parameter. The ``key`` should be randomly generated bytes and is recommended
+    to be as long as your hash function's output (e.g 256-bit for SHA256).
+    The ``length`` parameter controls the length of the generated one time
+    password and must be >= 6 and <= 8.
+
+    This is an implementation of :rfc:`6238`.
+
+    .. doctest::
+
+        >>> import os
+        >>> import time
+        >>> from cryptography.hazmat.backends import default_backend
+        >>> from cryptography.hazmat.primitives.twofactor.totp import TOTP
+        >>> from cryptography.hazmat.primitives.hashes import SHA1
+        >>> key = os.urandom(16)
+        >>> totp = TOTP(key, 8, SHA1(), 30, backend=default_backend())
+        >>> time_value = time.time()
+        >>> totp_value = totp.generate(time_value)
+        >>> totp.verify(totp_value, time_value)
+
+    :param bytes key: Per-user secret key. This value must be kept secret
+                      and be at least 128 bits. It is recommended that the
+                      key be 160 bits.
+    :param int length: Length of generated one time password as ``int``.
+    :param HashAlgorithm algorithm: A
+        :class:`~cryptography.hazmat.primitives.hashes`
+        provider.
+    :param int time_step: The time step size. The recommended size is 30.
+    :param backend: A
+        :class:`~cryptography.hazmat.backends.interfaces.HMACBackend`
+        provider.
+    :raises ValueError: This is raised if the provided ``key`` is shorter than
+        128 bits or if the ``length`` parameter is not 6, 7 or 8.
+    :raises TypeError: This is raised if the provided ``algorithm`` is not
+        :class:`~cryptography.hazmat.primitives.hashes.SHA1()`,
+        :class:`~cryptography.hazmat.primitives.hashes.SHA256()` or
+        :class:`~cryptography.hazmat.primitives.hashes.SHA512()` or if the
+        ``length`` parameter is not an integer.
+
+    .. method:: generate(time)
+
+        :param int time: The time value used to generate the one time password.
+        :return bytes: A one time password value.
+
+    .. method:: verify(totp, time)
+
+        :param bytes totp: The one time password value to validate.
+        :param int time: The time value to validate against.
+        :raises cryptography.exceptions.InvalidToken: This is raised when the
+            supplied TOTP does not match the expected TOTP.
diff --git a/docs/index.rst b/docs/index.rst
index c8ef41b6..a25f4470 100644
--- a/docs/index.rst
+++ b/docs/index.rst
@@ -33,6 +33,9 @@ existing libraries:
 * Poor introspectability, and thus poor testability.
 * Extremely error prone APIs, and bad defaults.
 
+
+.. _cryptography-layout:
+
 Layout
 ------
 
@@ -60,6 +63,7 @@ The recipes layer
     fernet
     random-numbers
     exceptions
+    faq
     glossary
 
 The hazardous materials layer
@@ -87,4 +91,10 @@ The ``cryptography`` open source project
     community
 
 
+.. note::
+
+    ``cryptography`` has not been subjected to an external audit of its code or
+    documentation. If you're interested in discussing an audit please
+    :doc:`get in touch </community>`.
+
 .. _`pre-compiled binaries`: https://www.openssl.org/related/binaries.html
diff --git a/docs/random-numbers.rst b/docs/random-numbers.rst
index cd73a7b7..12969d1c 100644
--- a/docs/random-numbers.rst
+++ b/docs/random-numbers.rst
@@ -8,8 +8,8 @@ want to use the standard :mod:`random` module APIs. This is because they do not
 provide a cryptographically secure random number generator, which can result in
 major security issues depending on the algorithms in use.
 
-Therefore, it is our recommendation to always use your operating system's
-provided random number generator, which is available as ``os.urandom()``. For
+Therefore, it is our recommendation to `always use your operating system's
+provided random number generator`_, which is available as ``os.urandom()``. For
 example, if you need 16 bytes of random data for an initialization vector, you
 can obtain them with:
 
@@ -18,3 +18,5 @@ can obtain them with:
     >>> import os
     >>> os.urandom(16)
     '...'
+
+.. _`always use your operating system's provided random number generator`: http://sockpuppet.org/blog/2014/02/25/safely-generate-random-numbers/
diff --git a/docs/spelling_wordlist.txt b/docs/spelling_wordlist.txt
index 14b0b773..bf5ae05e 100644
--- a/docs/spelling_wordlist.txt
+++ b/docs/spelling_wordlist.txt
@@ -13,11 +13,14 @@ cryptographically
 decrypt
 decrypted
 decrypting
+deserialize
+deserialized
 Docstrings
 fernet
 Fernet
 hazmat
 indistinguishability
+interoperable
 introspectability
 invariants
 iOS
@@ -25,6 +28,7 @@ pickleable
 plaintext
 pseudorandom
 Schneier
+scrypt
 testability
 unencrypted
 unpadded