Documentation
¶
Overview ¶
Package totp provides TOTP (RFC 6238) utilities for two-factor authentication.
Features:
- 6-digit codes, 30-second window, base32 secrets
- Recovery codes in XXXX-XXXX-XXXX format (SHA-256 hashed at rest)
- Secret encryption at rest using AES-GCM
Security:
- Adjacent window of +/-1 (~30s) absorbs clock drift
- Recovery codes use a 32-char alphabet (no 0/O/1/I) for readability
- All comparisons of hashes use constant-time comparison
- No secrets are ever logged
Index ¶
- func DecryptSecret(ciphertext string, key []byte) (string, error)
- func EncryptSecret(plaintext string, key []byte) (string, error)
- func GenerateQRURI(secret, email, issuer string) string
- func GenerateRecoveryCodes(n int) []string
- func GenerateSecret() (string, error)
- func HashRecoveryCode(code string) string
- func VerifyCode(secret, code string) bool
- func VerifyRecoveryCode(code, hash string) bool
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func DecryptSecret ¶
DecryptSecret decrypts a TOTP secret that was encrypted with EncryptSecret. The key must be exactly 32 bytes. Returns an error if the ciphertext is invalid, tampered with, or encrypted with a different key.
func EncryptSecret ¶
EncryptSecret encrypts a TOTP secret for at-rest storage using AES-256-GCM. The key must be exactly 32 bytes. Returns a base64-encoded string containing the nonce prepended to the ciphertext.
func GenerateQRURI ¶
GenerateQRURI builds an otpauth:// provisioning URI suitable for QR codes.
Format (RFC 6238 / Google Authenticator spec):
otpauth://totp/{issuer}:{email}?secret=...&issuer={issuer}&algorithm=SHA1&digits=6&period=30
func GenerateRecoveryCodes ¶
GenerateRecoveryCodes returns n cryptographically-random recovery codes in XXXX-XXXX-XXXX format. Each code uses a 32-char alphabet for 60 bits of entropy, matching Google/Microsoft backup-code strength.
func GenerateSecret ¶
GenerateSecret returns a fresh base32 TOTP secret (160-bit / 32-char).
func HashRecoveryCode ¶
HashRecoveryCode returns the SHA-256 hex digest of the canonicalized recovery code.
func VerifyCode ¶
VerifyCode verifies a 6-digit TOTP code against the secret. It checks the current time step plus +/-1 window (for clock drift).
func VerifyRecoveryCode ¶
VerifyRecoveryCode checks a recovery code against a stored SHA-256 hash using constant-time comparison to prevent timing attacks.
Types ¶
This section is empty.
Source Files