Librería para generación de tokens Totp y Hotp para MFA
License
—
Deps
0
Install Size
—
Vulns
✓ 0
Published
Aug 20, 2024
$ dotnet add package Bau.Libraries.OneTimePasswordImplementation of the TOTP (RFC 6238) and HOTP (RFC 4226) algorithms for generating one-time passwords with C#.
dotnet add package Bau.Libraries.OneTimePassword
A one-time password (OTP) algorithm is an authentication method that generates a unique and temporary password for a session. This type of password is used only once and expires after a brief period of time.
These algorithms are used to add an additional layer of security to applications, enabling two-factor authentication (2FA or MFA).
Key features of OTPs:
Several algorithms exist for generating OTP keys, and this library generates keys using HOTP or TOTP:
HOTP is an authentication method that generates unique and temporary passwords using a shared secret key and a counter. This algorithm is a fundamental part of the OATH (Initiative for Open Authentication) initiative.
See its specification in the document RFC 4226.
Key features of the HOTP algorithm:
HOTP algorithm workflow:
Advantages of the HOTP algorithm:
Disadvantages of the HOTP algorithm:
TOTP is an authentication method that generates unique and temporary passwords based on a shared secret key and the current time. This algorithm is a variant of the HOTP (HMAC-Based One-Time Password) algorithm and is widely used in two-factor authentication (2FA).
See its specification in the document RFC 6238.
Key features of the TOTP algorithm:
TOTP algorithm workflow:
Advantages of the TOTP algorithm:
Disadvantages of the TOTP algorithm:
To generate a HOTP key, we will use the HotpGenerator class. In the constructor, we need to specify:
Key: The key returned by the key server.Encoding: The encoding mode of the key returned by the key server (plain text, Base64, or Base32).Algorithm: The hashing algorithm used to obtain the resulting codes (Sha1, Sha256, Sha512). The default is SHA1.Digits: The number of characters generated by the code (6 to 8, typically 6).Once the class is initialized, we can access the validation code by calling the Compute method with the appropriate counter:
using Bau.Libraries.OneTimePassword;
HotpGenerator hotp = new("KEY", Secret.Encoding.Plain, BaseTokenGenerator.HashAlgorithm.Sha1, 6);
string code = hotp.Compute(19238);To generate a TOTP key, we will use the TotpGenerator class. In the constructor, we need to specify:
Key: The key returned by the key server.Encoding: The encoding mode of the key returned by the key server (plain text, Base64, or Base32).Algorithm: The hashing algorithm used to obtain the resulting codes (Sha1, Sha256, Sha512). The default is SHA1.Digits: The number of characters generated by the code (6 to 8, typically 6).Once the class is initialized, we can obtain the validation code by calling the Compute method:
using Bau.Libraries.OneTimePassword;
TotpGenerator totp = new("KEY", Secret.Encoding.Plain, BaseTokenGenerator.HashAlgorithm.Sha1, 6);
string code = totp.Compute();In this case, if no date is passed, the system date is used, but we can specify a specific date:
string code = totp.Compute(new DateTime(2024, 8, 2, 17, 30, 5));or use long specifying the Unix date (number of ticks since January 1, 1970):
string code = totp.Compute(1_991_289);Initially, the validity period of the key is 30 seconds, but we can modify it at any time:
using Bau.Libraries.OneTimePassword;
TotpGenerator totp = new("KEY", Secret.Encoding.Plain, BaseTokenGenerator.HashAlgorithm.Sha1, 6);
totp.TimeManager.IntervalSeconds = 60;
string code = totp.Compute();The codes generated by TotpGenerator are valid for 30 seconds or the specified interval, but this time is measured not from the code generation but from the start of the interval of the specified date. For example, if we generate the code at 12:05, the start of the generation window will be 12:00, and we will have 25 seconds of validity left.
To check the remaining validity time of the code (for example, to display it in an application), we can use the GetRemainingSeconds method of the TopTimeManager class, where methods related to the date are grouped:
using Bau.Libraries.OneTimePassword;
TotpGenerator totp = new("KEY", Secret.Encoding.Plain, BaseTokenGenerator.HashAlgorithm.Sha1, 6);
totp.TimeManager.IntervalSeconds = 60;
string code = totp.Compute(DateTime.UtcNow);
int remainingSeconds = totp.TimeManager.GetRemainingSeconds(DateTime.UtcNow);This project is based on Otp.Net developed by Kyle Spearrin.