hotp

Documentation

Index

• Variables
• type Generator
  • func (g *Generator) Generate(secret []byte, count uint64) (string, error)
  • func (g *Generator) Truncate(sum []byte) (string, error)
  • func (g *Generator) Validate(code string, secret []byte, count uint64) (bool, error)

Variables

var (
	ErrInvalidSumLength = errors.New("sum must be greater than or equal to 160 bits")
)

Types

type Generator

type Generator struct {
	// Hash function used to generate the HOTP codes. Note that if implementing STRICTLY for HOTP, this hash must be an
	// SHA-1 hash. However, HOTP is also used for TOTP implementations, which allows for SHA256 and SHA512.
	Hash func() hash.Hash

	// Number of digits to return as the code. This number must be between 6-8.
	NumDigits int
}

Generator is a generic generator for HOTP codes.

func (*Generator) Generate

func (g *Generator) Generate(secret []byte, count uint64) (string, error)

Generate will generate an OTP from a secret and a count. In the HOTP spec, count must be an 8-byte number. Thus, we are using uint64

func (*Generator) Truncate

func (g *Generator) Truncate(sum []byte) (string, error)

Truncate implements the Dynamic Truncation algorithm in https://datatracker.ietf.org/doc/html/rfc4226#section-5.4 This algorithm not only truncates but also returns it as a numeric string.

What it does is use the lowest 4 bits of the string as the offset for selecting a location to truncate. It then takes 4 bytes from that byte value and applies MOD 10^(num-digits) to end up with a numeric string.

In the case of HOTP, this "sum" would be a 20 byte string. However, this will not be true for SHA256 and SHA512. Based on the example code in https://datatracker.ietf.org/doc/html/rfc6238#page-13, what is used as offset is just the final digits regardless of string length.

func (*Generator) Validate

func (g *Generator) Validate(code string, secret []byte, count uint64) (bool, error)

Validate validates a provided code for a certain secret and count.