$hotp » History » Version 7
Paul Janson, 03/25/2021 08:21 PM
1 | 1 | Per Amundsen | _Added in 3.3_ |
---|---|---|---|
2 | |||
3 | 7 | Paul Janson | *$hotp(<key>, <count>, [hash], [digits], [encoding])* |
4 | 1 | Per Amundsen | |
5 | Returns an HOTP (HMAC-based One-Time Password) based on the specified parameters. |
||
6 | |||
7 | 7 | Paul Janson | _HOTP is designed for hashes no shorter than 160 bits, so using md5 hash is not secure enough and should never be used with $hotp._ |
8 | 4 | Per Amundsen | |
9 | _See also [[$totp]], [[$hmac]]._ |
||
10 | |||
11 | 1 | Per Amundsen | *Parameters* |
12 | |||
13 | 7 | Paul Janson | key - The key to hash. (Auto-detected between text/hex/base32 as described below) |
14 | count - a unique (sequential) number. valid range 0-2^64-1 |
||
15 | 1 | Per Amundsen | hash - Hash method to hash the key with. (sha1, sha256, sha384, sha512, md5, sha1 is default) |
16 | 7 | Paul Janson | digits - Number of digits to return. (3 - 10, default is 6) *(AdiIRC only: digits=0 returns entire internal HMAC string)* |
17 | encoding - Sets encoding method for 'key'. (t = UTF8 plain text, x = hex, a = base32) *(AdiIRC only)* |
||
18 | |||
19 | Default when 'encoding' is not used, attempts to support 'key' in several formats as follows: |
||
20 | |||
21 | if (key length excluding spaces is any of lengths 40|64|128 and $remove(key,$chr(32)) is hex ) encoding = x |
||
22 | if (key length excluding spaces is any of lengths 16|26|32 and $remove(key,$chr(32)) is base32) encoding = a |
||
23 | These assume hex keys of 160|256|512 bits, or base32 keys of 80|128|160 bits. all other cases: encoding = t |
||
24 | encoding 'x' or 'a' ignore all spaces padding, but 't' does not. All encoding formats reject key being $null or entirely consisting of spaces. |
||
25 | |||
26 | Note: definition of base32 is case-insensitive [a-zA-Z2-7] after removing spaces, and '=' padding is NOT allowed |
||
27 | |||
28 | Note: It's recommended that the secret 'key' contain entropy no less than the bit length of the 'hash' used. Also, hash blocklength is 64 except for sha512|sha384 having 128. Key is shortened to hash(key) if key is longer than 'blocklength'. i.e. Using key longer than 512 bits with hash=sha1 shortens key to 160 bits: |
||
29 | |||
30 | //var -s %key $regsubex(foo,$str(x,65),/x/g,$rand(a,z)) | echo -a $hotp(%key,123) same as $hotp($sha1(%key),123) |
||
31 | (Equivalence is due to the length 40 string seen as encoding=x) |