Time-based one-time password algorithm: Difference between revisions
mNo edit summary |
m Add 'GenerateSecret' method |
||
Line 91: | Line 91: | ||
} |
} |
||
Quit str |
Quit str |
||
} |
|||
ClassMethod GenerateSecret() As %String |
|||
{ |
|||
// initialise base 32 string and alphabet |
|||
Set b32str="", b32alp="ABCDEFGHIJKLMNOPQRSTUVWXYZ234567" |
|||
// build a large base 32 string |
|||
For pass=1:1:4 { |
|||
Set b32str=b32str_..ConvertBase10ToN($System.Encryption.GenCryptToken(), 32, b32alp) |
|||
} |
|||
// return randomly generated password |
|||
Quit ..LeftPad(b32str, 16) |
|||
} |
} |
||
Line 103: | Line 117: | ||
169898 |
169898 |
||
487462 |
487462 |
||
DEMO>write ##class(User.View.Security).GenerateSecret() |
|||
5FWQZLQVXIBCKKMJ |
|||
DEMO>write ##class(User.View.Security).GenerateSecret() |
|||
M4AKQBFI252H4BWO |
|||
</pre> |
</pre> |
Revision as of 22:02, 24 September 2014
This page uses content from Wikipedia. The original article was at Time-based one-time password algorithm. The list of authors can be seen in the page history. As with Rosetta Code, the text of Wikipedia is available under the GNU FDL. (See links for details on variance) |
A Time-based One-time Password Algorithm (TOTP) is an algorithm that computes a one-time password from a shared secret key and the current time. It is the cornerstone of Initiative For Open Authentication (OATH) and is used in a number of two factor authentication systems. Essentially, both the server and the client compute the time-limited token, then the server checks if the token supplied by the client matches the locally generated token.
The task here is to implement this algorithm using 'HMAC-SHA1' and an optional step is to generate the random Base-32 string used as the secret key, but this is not a requirement. A reference implementation, based on JavaScript, can be found at the following location:
http://blog.tinisles.com/2011/10/google-authenticator-one-time-password-algorithm-in-javascript
According to RFC 6238, the reference implementation is as follows:
- Generate a key, K, which is an arbitrary bytestring, and share it securely with the client.
- Agree upon an epoch, T0, and an interval, TI, which will be used to calculate the value of the counter C (defaults are the Unix epoch as T0 and 30 seconds as TI)
- Agree upon a cryptographic hash method (default is SHA-1)
- Agree upon a token length, N (default is 6)
Although RFC 6238 allows different parameters to be used, the Google implementation of the authenticator app does not support T0, TI values, hash methods and token lengths different from the default. It also expects the K secret key to be entered (or supplied in a QR code) in base-32 encoding according to RFC 3548.
- Google Authenticator App (Apple iOS)
- Google Authenticator App (Google Android)
- Microsoft Authenticator App (Windows Phone)
Caché ObjectScript
<lang cos> Class Utils.Security [ Abstract ] {
ClassMethod GetOTP(b32secret As %String) As %String { // convert base32 secret into string Set key=..B32ToStr(b32secret)
// get the unix time, divide by 30 and convert into eight-byte string Set epoch=..GetUnixTime() Set val=$Reverse($ZQChar(epoch\30))
// compute the HMAC SHA-1 hash and get the last nibble... Set hmac=$System.Encryption.HMACSHA1(val, key) Set last=$ASCII($Extract(hmac, *))
// calculate the offset and get one-time password string Set offset=$ZBoolean(last, $Char(15), 1) // logical 'AND' operation Set otpstr=$ZBoolean($Extract(hmac, offset+1, offset+4), $Char(127,255,255,255), 1)
// convert string into decimal and return last six digits Set otpdec=$ZLASCII($Reverse(otpstr)) Quit ..LeftPad(otpdec, 6) }
ClassMethod GetUnixTime() As %Integer [ Private ] { // current date and time in UTC time format Set now=$ZTimeStamp Set daydiff=(now - $ZDateH("1970-01-01", 3)) Set secs=$Piece(now, ",", 2)\1 Quit (daydiff*60*60*24)+secs }
ClassMethod LeftPad(str As %String, len As %Integer, pad As %String = 0) As %String [ Private ] { Quit $Extract($Translate($Justify(str, len), " ", pad), *-(len-1), *) }
ClassMethod ConvertBase10ToN(pNum As %Integer = "", pBase As %Integer = "", pBaseStr As %String = "", pPos As %Integer = 0) As %String [ Private ] { If pNum=0 Quit "" Set str=..ConvertBase10ToN(pNum\pBase, pBase, pBaseStr, pPos+1) Quit str_$Extract(pBaseStr, pNum#pBase+1) }
ClassMethod ConvertBaseNTo10(pStr As %String = "", pBase As %Integer = "", pBaseStr As %String = "", pPos As %Integer = 0) As %Integer [ Private ] { If pStr="" Quit 0 Set num=..ConvertBaseNTo10($Extract(pStr, 1, *-1), pBase, pBaseStr, pPos+1) Set dec=$Find(pBaseStr, $Extract(pStr, *))-2 Quit num+(dec*(pBase**pPos)) }
ClassMethod B32ToStr(b32str As %String) As %String [ Private ] { Set b32str=$ZConvert(b32str,"U") Set b32alp="ABCDEFGHIJKLMNOPQRSTUVWXYZ234567" Set (bits,str)="" For i=1:1:$Length(b32str) { Set val=$Find(b32alp, $Extract(b32str, i))-2 Set bits=bits_..LeftPad(..ConvertBase10ToN(val, 2, "01"), 5) } For i=1:8:$Length(bits) { Set chunk=$Extract(bits, i, i+7) Set str=str_$Char(..ConvertBaseNTo10(chunk, 2, "01")) } Quit str }
ClassMethod GenerateSecret() As %String { // initialise base 32 string and alphabet Set b32str="", b32alp="ABCDEFGHIJKLMNOPQRSTUVWXYZ234567"
// build a large base 32 string For pass=1:1:4 { Set b32str=b32str_..ConvertBase10ToN($System.Encryption.GenCryptToken(), 32, b32alp) }
// return randomly generated password Quit ..LeftPad(b32str, 16) }
} </lang>
- Example:
DEMO>for i=1:1:5 write ##class(Utils.Security).GetOTP("JBSWY3DPEHPK3PXP"),! hang 15 // wait fifteen seconds 992374 992374 169898 169898 487462 DEMO>write ##class(User.View.Security).GenerateSecret() 5FWQZLQVXIBCKKMJ DEMO>write ##class(User.View.Security).GenerateSecret() M4AKQBFI252H4BWO