Documentation
¶
Overview ¶
Package totp implements time-based one-time passwords (RFC 6238, the algorithm every mainstream authenticator app speaks) plus the small amount of supporting logic 2FA needs: secret generation, an otpauth:// provisioning URI, and single-use recovery codes.
No third-party dependency: the algorithm is HMAC-SHA1 (crypto/hmac, crypto/sha1) over a big-endian 8-byte counter, base32-decoded key (encoding/base32), all stdlib. Adding a library for this would be adding a dependency for something the standard library already covers completely.
Index ¶
- func GenerateCode(secretBase32 string, now time.Time) (string, error)
- func GenerateRecoveryCode() (string, error)
- func GenerateSecret() (string, error)
- func NormalizeRecoveryCode(code string) string
- func ProvisioningURI(secretBase32, accountName, issuer string) string
- func Validate(secretBase32, code string, now time.Time) bool
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func GenerateCode ¶
GenerateCode returns the 6-digit TOTP for secretBase32 at the step containing now, with no clock-skew tolerance (that's Validate's job, which calls this internally): the symmetric counterpart callers need wherever something other than a live authenticator app must produce a code, e.g. tests exercising the confirm/verify handlers end to end.
func GenerateRecoveryCode ¶
GenerateRecoveryCode returns one single-use fallback code: 80 random bits, base32-encoded, grouped into four hyphenated blocks of four characters for readability when typed by hand.
func GenerateSecret ¶
GenerateSecret returns a fresh random base32-encoded TOTP secret.
func NormalizeRecoveryCode ¶
NormalizeRecoveryCode strips whitespace and hyphens and uppercases a recovery code, so a user's re-typed or copy-pasted input matches regardless of formatting differences from GenerateRecoveryCode's own output.
func ProvisioningURI ¶
ProvisioningURI builds the otpauth:// key URI most authenticator apps accept either scanned as a QR code or pasted directly, per Google Authenticator's key URI format. issuer and accountName are shown to the user inside their authenticator app to distinguish this entry from others, and both belong in the label and as an issuer query param per that same format's own recommendation (some apps only read one or the other).
Types ¶
This section is empty.
Source Files