xarenard / simpleotp

Simple OTP implementation in node.js according to rfc 4996 and rfc 6238

Simple OTP

Time-based and HMAC-based One-Time Password libraryfor node.js

• About
• Installation
• Usage
  • HOTP
    • Example
    • Configuration
  • TOTP
    • Example
    • Configuration
• Test
• References
• License

About

simpleotp is a simple :-) OTP library for node.js.

It provides an implementation of both rfc 4226 (HOTP) and rfc 6238 (TOTP).

Installation

npm install --save simpleotp

Usage

HOTP

Example

const otp = require('simpleotp');
const hotp = new otp.Hotp();

// generate a token
const token = hotp.createToken({secret:'12345678901234567890',counter:7});

// validate the token
const data = {token: token, secret:'12345678901234567890',counter: 7};
const valid = hotp.validate(data); //true

Configuration

Constructor options

Option	Value	Description	Default Value
algorithm	sha1,sha256,sha512	Algorithm to use	sha1
num_digits	integer	token length	6
encoding	ascii	Encoding of the secret	ascii

Create Token options

Option	Mandatory	Value	Description	Default value
secret	y	string type	Share secret to use	N/A
counter	y	integer type	The counter seed	N/A
algorithm	n	'sha1','sha256' or 'sha512'	Algorithm to use	sha1
num_digits	n	integer type	token length	6
encoding	n	'ascii'	Encoding of the secret	ascii

Validate token options

Option	Mandatory	Value	Description	Default value
token	y	string type	The original token	N/A
secret	y	string type	Share secret to use	N/A
counter	y	integer type	The counter seed	N/A
algorithm	n	'sha1','sha256' or 'sha512'	Algorithm to use	sha1
num_digits	n	integer type	token length	6
encoding	n	'ascii'	Encoding of the secret	ascii

TOTP

Example

const otp = require('simpleotp');
const totp = new otp.Totp();

// generate the token
const token = totp.createToken({secret:'12345678901234567890',seconds :Date.now()/1000});

// validate the token
const data = {token: token, secret:'12345678901234567890',seconds :Date.now()/1000}
const valid = totp.validate(data)
console.log(valid); // true

Configuration

Constructor options

Option	Value	Description	Default value
algorithm	'sha1','sha256' or 'sha512'	Algorithm to use	sha1
num_digits	integer	token length	6
encoding	ascii	Encoding of the secret	ascii
step	integer	Number of the second the token is valid	30

Create Token options

Option	Mandatory	Value	Description	Default value
secret	y	string type	Share secret to use	N/A
seconds	y	integer	time in seconds as counter	Date.now()/1000
step	n	integer	Number of the second the token is valid	30
algorithm	n	'sha1','sha256' or 'sha512'	Algorithm to use	sha1
num_digits	n	integer type	token length	6
encoding	n	'ascii'	Encoding of the secret	ascii

Validate token options

Option	Mandatory	Value	Description	Default value
token	y	string type	The original token	N/A
secret	y	string type	Share secret to use	N/A
seconds	Y	integer	time in seconds as counter	Date.now()/1000
step	n	integer	Number of the second the token is valid	30
algorithm	n	'sha1','sha256' or 'sha512'	Algorithm to use	sha1
num_digits	n	integer type	token length	8
encoding	n	'ascii'	Encoding of the secret	ascii

Tests

npm test

References

License

simpleotp is MIT licensed

simpleotp's Issues

sha1 algorithm only worked

fix this function
add const algorithm to options to create the same validate token

Hotp.prototype.validate = function (data) {
    const expectedToken = data.token;
    const counter = data.counter;
    const secret = data.secret;
    const window = data.window;
    const num_digits = this.options.num_digits;
    **const algorithm = data.algorithm;**

let isValid = false;
let window_frame = counter + (window || 0);

let i = counter;
while(i <= window_frame && !isValid){
	let token = this.createToken({num_digits: num_digits,counter:i,secret: secret,encoding: data.encoding ,**algorithm: data.algorithm**});
	if (token.toString() === expectedToken) {
		isValid = true;
	}
	i++;
}
return isValid;

};

Token code not zero-padded to correct length

simpleotp/lib/otp.js

Line 76 in c974078

if (token.length < num_digits) {

Hi @xarenard ,

I noticed that tokens that begin with a leading 0 are sometimes not the correct length.

The problem is that the if statement in the referenced line will only add one zero.
If there are two or more leading zeros required, the generated code is not the correct length.

// Sample rfc_6238 test data - should be of length "8"

const testDatas = [
  // ...
  { seconds: 3060, algorithm: 'sha1', expected_token: '00629694' },
  { seconds: 4620, algorithm: 'sha256', expected_token: '00836417' },
  { seconds: 5100, algorithm: 'sha512', expected_token: '00458766' }
]

I can submit a PR if you'd like, but it should just be a matter of updating this if statement to a while loop.