JarCasting
JarCasting JarCasting

Time based one time password

Java Implementation of TOTP: Time-Based One-Time Password Algorithm

License

License
GroupId

GroupId

com.webarity
ArtifactId

ArtifactId

time-based-one-time-password
Last Version

Last Version

1.0.0
Release Date

Release Date
Type

Type

jar
Description

Description

Time based one time password
Java Implementation of TOTP: Time-Based One-Time Password Algorithm
Project URL

Project URL

https://www.webarity.com/time-based-one-time-password/
Source Code Management

Source Code Management

https://github.com/hrsto/time-based-one-time-password

Download time-based-one-time-password

Filename Size
time-based-one-time-password-1.0.0.pom
time-based-one-time-password-1.0.0.jar 5 KB
time-based-one-time-password-1.0.0-sources.jar 4 KB
time-based-one-time-password-1.0.0-javadoc.jar 398 KB
Browse

How to add to project

<!-- https://jarcasting.com/artifacts/com.webarity/time-based-one-time-password/ -->
<dependency>
    <groupId>com.webarity</groupId>
    <artifactId>time-based-one-time-password</artifactId>
    <version>1.0.0</version>
</dependency>
// https://jarcasting.com/artifacts/com.webarity/time-based-one-time-password/
implementation 'com.webarity:time-based-one-time-password:1.0.0'
// https://jarcasting.com/artifacts/com.webarity/time-based-one-time-password/
implementation ("com.webarity:time-based-one-time-password:1.0.0")
'com.webarity:time-based-one-time-password:jar:1.0.0'
<dependency org="com.webarity" name="time-based-one-time-password" rev="1.0.0">
  <artifact name="time-based-one-time-password" type="jar" />
</dependency>
@Grapes(
@Grab(group='com.webarity', module='time-based-one-time-password', version='1.0.0')
)
libraryDependencies += "com.webarity" % "time-based-one-time-password" % "1.0.0"
[com.webarity/time-based-one-time-password "1.0.0"]

Dependencies

There are no dependencies for this project. It is a standalone project that does not depend on any other jars.

Project Modules

There are no modules declared in this project.

Java Implementation of TOTP: Time-Based One-Time Password Algorithm

Uses Google Authenticator as the base to provide quick and dirty library as a start for further development of 2fa solutions based on TOTP.

Usage

Get the dependency via Maven with coords:

<dependency>
  <groupId>com.webarity</groupId>
  <artifactId>time-based-one-time-password</artifactId>
  <version>1.0.0</version>
</dependency>

Install Google Authenticator (or anything similar to it from anywhere) from the google play store and set it up for time based passwords and give it a shared secret. Then:

TimeOneTimePassword.HMACSHA1.oneTimePassword("mysharedsecrethere"); //uses the defaults of 0 unix start time, 30 seconds interval steps, and 6 pin length
TimeOneTimePassword.HMACSHA1.oneTimePassword("mysharedsecrethere", 6); //with pin length
TimeOneTimePassword.HMACSHA1.oneTimePassword("mysharedsecrethere", 0, 30, 6); //with start time, time step, and pin lenght
TimeOneTimePassword.HMACSHA1.oneTimePassword("mysharedsecrethere", System.currentTimeMillis() / 1000, 0, 30, 6); //with the current _now_ time in seconds, start time, time step, and pin length

Abstract

For reference, see RFC 6238 TOTP: Time-Based One-Time Password Algorithm.

Abbreviations used:

  • HOTP - HMAC one time password (with SHA1 hash function)
  • TOTP - time base one time password
  • OTP - one time password

Algorithm is defined as:

T = Math.floor((Ut - T0) / X)
TOTP = HOTP(K,T)

Where:

  • Ut - current Unix epoch time in seconds. In java it would look like System.currentTimeMillis() / 1000. In JavaScript - Date.now() / 1000
  • X - time step in seconds (30 by default for Google Authenticator)
  • T0 - unix time to start counting time steps, defaults to 0

HOTP uses HMAC SHA 1 and is applied to increasing counter value that represents the message in the HMAC computation. The result is then truncated to obtain user-friendly vals using:

HOTP(K, C) = Truncate(HMAK-sha-1(K, C))

Truncate converts HMAC SHA 1 val into HOTP value.

  • K - shared secret
  • C - counter value - in TOTP, this val will be T (see above). TOTP may use SHA 256 or SHA 512 instead of HMAC SHA 1.

Due to lag, when client sends his OTP, server may receive it when the time window ends, thus the server may have to allow for a buffer time and compare the received OTP with, at most, the previous one.

https://www.webarity.com

Versions

Version
1.0.0