rotp 2.1.1 → 6.2.2

data/lib/rotp/base32.rb

@@ -1,49 +1,76 @@
+require 'securerandom'
+
 module ROTP
   class Base32
     class Base32Error < RuntimeError; end
-    CHARS = "abcdefghijklmnopqrstuvwxyz234567".each_char.to_a
+    CHARS = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ234567'.each_char.to_a
+    SHIFT = 5
+    MASK = 31
 
     class << self
+
       def decode(str)
-        output = []
-        str.scan(/.{1,8}/).each do |block|
-          char_array = decode_block(block).map{|c| c.chr}
-          output << char_array
+        buffer = 0
+        idx = 0
+        bits_left = 0
+        str = str.tr('=', '').upcase
+        result = []
+        str.split('').each do |char|
+          buffer = buffer << SHIFT
+          buffer = buffer | (decode_quint(char) & MASK)
+          bits_left = bits_left + SHIFT
+          if bits_left >= 8
+            result[idx] = (buffer >> (bits_left - 8)) & 255
+            idx = idx + 1
+            bits_left = bits_left - 8
+          end
         end
-        output.join
+        result.pack('c*')
       end
 
-      def random_base32(length=16)
-        b32 = ''
-        OpenSSL::Random.random_bytes(length).each_byte do |b|
-          b32 << CHARS[b % 32]
+      def encode(b)
+        data = b.unpack('c*')
+        out = String.new
+        buffer = data[0]
+        idx = 1
+        bits_left = 8
+        while bits_left > 0 || idx < data.length
+          if bits_left < SHIFT
+            if idx < data.length
+              buffer = buffer << 8
+              buffer = buffer | (data[idx] & 255)
+              bits_left = bits_left + 8
+              idx = idx + 1
+            else
+              pad = SHIFT - bits_left
+              buffer = buffer << pad
+              bits_left = bits_left + pad
+            end
+          end
+          val = MASK & (buffer >> (bits_left - SHIFT))
+          bits_left = bits_left - SHIFT
+          out.concat(CHARS[val])
         end
-        b32
+        return out
       end
 
-      private
+      # Defaults to 160 bit long secret (meaning a 32 character long base32 secret)
+      def random(byte_length = 20)
+       rand_bytes = SecureRandom.random_bytes(byte_length)
+       self.encode(rand_bytes)
+      end
 
-      def decode_block(block)
-        length = block.scan(/[^=]/).length
-        quints = block.each_char.map {|c| decode_quint(c)}
-        bytes = []
-        bytes[0] = (quints[0] << 3) + (quints[1] ? quints[1] >> 2 : 0)
-        return bytes if length < 3
-        bytes[1] = ((quints[1] & 3) << 6) + (quints[2] << 1) + (quints[3] ? quints[3] >> 4 : 0)
-        return bytes if length < 4
-        bytes[2] = ((quints[3] & 15) << 4) + (quints[4] ? quints[4] >> 1 : 0)
-        return bytes if length < 6
-        bytes[3] = ((quints[4] & 1) << 7) + (quints[5] << 2) + (quints[6] ? quints[6] >> 3 : 0)
-        return bytes if length < 7
-        bytes[4] = ((quints[6] & 7) << 5) + (quints[7] || 0)
-        bytes
+      # Prevent breaking changes
+      def random_base32(str_len = 32)
+        byte_length = str_len * 5/8
+        random(byte_length)
       end
 
+      private
+
       def decode_quint(q)
-        CHARS.index(q.downcase) or raise(Base32Error, "Invalid Base32 Character - '#{q}'")
+        CHARS.index(q) || raise(Base32Error, "Invalid Base32 Character - '#{q}'")
       end
-
     end
-
   end
 end

data/lib/rotp/cli.rb

@@ -9,19 +9,19 @@ module ROTP
       @argv = argv
     end
 
+    # :nocov:
     def run
       puts output
     end
+    # :nocov:
 
     def errors
-      if [:time, :hmac].include?(options.mode)
+      if %i[time hmac].include?(options.mode)
         if options.secret.to_s == ''
           red 'You must also specify a --secret. Try --help for help.'
-        elsif options.secret.to_s.chars.any? { |c| ROTP::Base32::CHARS.index(c.downcase) == nil }
+        elsif options.secret.to_s.chars.any? { |c| ROTP::Base32::CHARS.index(c.upcase).nil? }
           red 'Secret must be in RFC4648 Base32 format - http://en.wikipedia.org/wiki/Base32#RFC_4648_Base32_alphabet'
         end
-      elsif options.mode == :hmac && options.counter.to_i < 0
-        red 'You must also specify a --counter. Try --help for help.'
       end
     end
 
@@ -31,12 +31,9 @@ module ROTP
       return arguments.to_s if options.mode == :help
 
       if options.mode == :time
-        ROTP::TOTP.new(options.secret).now
+        ROTP::TOTP.new(options.secret, options).now
       elsif options.mode == :hmac
-        ROTP::HOTP.new(options.secret).at options.counter
-
-      else
-        fail NotImplementedError
+        ROTP::HOTP.new(options.secret, options).at options.counter
       end
     end
 
@@ -51,6 +48,5 @@ module ROTP
     def red(string)
       "\033[31m#{string}\033[0m"
     end
-
   end
 end

data/lib/rotp/hotp.rb

@@ -2,33 +2,20 @@ module ROTP
   class HOTP < OTP
     # Generates the OTP for the given count
     # @param [Integer] count counter
-    # @option [Boolean] padding (false) Issue the number as a 0 padded string
     # @returns [Integer] OTP
-    def at(count, padding=true)
-      generate_otp(count, padding)
+    def at(count)
+      generate_otp(count)
     end
 
     # Verifies the OTP passed in against the current time OTP
-    # @param [String/Integer] otp the OTP to check against
-    # @param [Integer] counter the counter of the OTP
-    def verify(otp, counter)
-      super(otp, self.at(counter))
-    end
-
-    # Verifies the OTP passed in against the current time OTP, with a given number of retries.
-    # Returns the counter that was verified successfully
-    # @param [String/Integer] otp the OTP to check against
-    # @param [Integer] initial counter the counter of the OTP
-    # @param [Integer] number of retries
-    def verify_with_retries(otp, initial_count, retries = 1)
-      return false if retries <= 0
-
-      1.upto(retries) do |counter|
-        current_counter = initial_count + counter
-        return current_counter if verify(otp, current_counter)
+    # @param otp [String/Integer] the OTP to check against
+    # @param counter [Integer] the counter of the OTP
+    # @param retries [Integer] number of counters to incrementally retry
+    def verify(otp, counter, retries: 0)
+      counters = (counter..counter + retries).to_a
+      counters.find do |c|
+        super(otp, at(c))
       end
-
-      false
     end
 
     # Returns the provisioning URI for the OTP
@@ -37,10 +24,8 @@ module ROTP
     # @param [String] name of the account
     # @param [Integer] initial_count starting counter value, defaults to 0
     # @return [String] provisioning uri
-    def provisioning_uri(name, initial_count=0)
-      encode_params("otpauth://hotp/#{URI.encode(name)}", :secret=>secret, :counter=>initial_count)
+    def provisioning_uri(name, initial_count = 0)
+      OTP::URI.new(self, account_name: name, counter: initial_count).to_s
     end
-
   end
-
 end

data/lib/rotp/otp/uri.rb

@@ -0,0 +1,79 @@
+module ROTP
+  class OTP
+    # https://github.com/google/google-authenticator/wiki/Key-Uri-Format
+    class URI
+      def initialize(otp, account_name:, counter: nil)
+        @otp = otp
+        @account_name = account_name
+        @counter = counter
+      end
+
+      def to_s
+        "otpauth://#{type}/#{label}?#{parameters}"
+      end
+
+      private
+
+      def algorithm
+        return unless %w[sha256 sha512].include?(@otp.digest)
+
+        @otp.digest.upcase
+      end
+
+      def counter
+        return if @otp.is_a?(TOTP)
+        fail if @counter.nil?
+
+        @counter
+      end
+
+      def digits
+        return if @otp.digits == DEFAULT_DIGITS
+
+        @otp.digits
+      end
+
+      def issuer
+        return if @otp.is_a?(HOTP)
+
+        @otp.issuer&.strip&.tr(':', '_')
+      end
+
+      def label
+        [issuer, @account_name.rstrip]
+          .compact
+          .map { |s| s.tr(':', '_') }
+          .map { |s| ERB::Util.url_encode(s) }
+          .join(':')
+      end
+
+      def parameters
+        {
+          secret: @otp.secret,
+          issuer: issuer,
+          algorithm: algorithm,
+          digits: digits,
+          period: period,
+          counter: counter,
+        }
+          .reject { |_, v| v.nil? }
+          .map { |k, v| "#{k}=#{ERB::Util.url_encode(v)}" }
+          .join('&')
+      end
+
+      def period
+        return if @otp.is_a?(HOTP)
+        return if @otp.interval == DEFAULT_INTERVAL
+
+        @otp.interval
+      end
+
+      def type
+        case @otp
+        when TOTP then 'totp'
+        when HOTP then 'hotp'
+        end
+      end
+    end
+  end
+end

data/lib/rotp/otp.rb

@@ -1,26 +1,26 @@
 module ROTP
   class OTP
     attr_reader :secret, :digits, :digest
+    DEFAULT_DIGITS = 6
 
     # @param [String] secret in the form of base32
     # @option options digits [Integer] (6)
-    #     Number of integers in the OTP
+    #     Number of integers in the OTP.
     #     Google Authenticate only supports 6 currently
     # @option options digest [String] (sha1)
-    #     Digest used in the HMAC
+    #     Digest used in the HMAC.
     #     Google Authenticate only supports 'sha1' currently
     # @returns [OTP] OTP instantiation
     def initialize(s, options = {})
-      @digits = options[:digits] || 6
-      @digest = options[:digest] || "sha1"
+      @digits = options[:digits] || DEFAULT_DIGITS
+      @digest = options[:digest] || 'sha1'
       @secret = s
     end
 
     # @param [Integer] input the number used seed the HMAC
-    # @option padded [Boolean] (false) Output the otp as a 0 padded string
     # Usually either the counter, or the computed integer
     # based on the Unix timestamp
-    def generate_otp(input, padded=true)
+    def generate_otp(input)
       hmac = OpenSSL::HMAC.digest(
         OpenSSL::Digest.new(digest),
         byte_secret,
@@ -29,22 +29,19 @@ module ROTP
 
       offset = hmac[-1].ord & 0xf
       code = (hmac[offset].ord & 0x7f) << 24 |
-        (hmac[offset + 1].ord & 0xff) << 16 |
-        (hmac[offset + 2].ord & 0xff) << 8 |
-        (hmac[offset + 3].ord & 0xff)
-      if padded
-        (code % 10 ** digits).to_s.rjust(digits, '0')
-      else
-        code % 10 ** digits
-      end
+             (hmac[offset + 1].ord & 0xff) << 16 |
+             (hmac[offset + 2].ord & 0xff) << 8 |
+             (hmac[offset + 3].ord & 0xff)
+      code_str = (10 ** digits + (code % 10 ** digits)).to_s
+      code_str[-digits..-1]
     end
 
     private
 
     def verify(input, generated)
-      unless input.is_a?(String) && generated.is_a?(String)
-        raise ArgumentError, "ROTP only verifies strings - See: https://github.com/mdp/rotp/issues/32"
-      end
+      raise ArgumentError, '`otp` should be a String' unless
+          input.is_a?(String)
+
       time_constant_compare(input, generated)
     end
 
@@ -57,34 +54,26 @@ module ROTP
     # along with the secret
     #
     def int_to_bytestring(int, padding = 8)
+      unless int >= 0
+        raise ArgumentError, '#int_to_bytestring requires a positive number'
+      end
+
       result = []
       until int == 0
         result << (int & 0xFF).chr
-        int >>=  8
+        int >>= 8
       end
       result.reverse.join.rjust(padding, 0.chr)
     end
 
-    # A very simple param encoder
-    def encode_params(uri, params)
-      params_str = "?"
-      params.each do |k,v|
-        if v
-          params_str << "#{k}=#{CGI::escape(v.to_s)}&"
-        end
-      end
-      params_str.chop!
-      uri + params_str
-    end
-
     # constant-time compare the strings
     def time_constant_compare(a, b)
       return false if a.empty? || b.empty? || a.bytesize != b.bytesize
+
       l = a.unpack "C#{a.bytesize}"
       res = 0
       b.each_byte { |byte| res |= byte ^ l.shift }
       res == 0
     end
-
   end
 end

data/lib/rotp/totp.rb

@@ -1,7 +1,6 @@
 module ROTP
   DEFAULT_INTERVAL = 30
   class TOTP < OTP
-
     attr_reader :interval, :issuer
 
     # @option options [Integer] interval (30) the time interval in seconds for OTP
@@ -14,54 +13,69 @@ module ROTP
 
     # Accepts either a Unix timestamp integer or a Time object.
     # Time objects will be adjusted to UTC automatically
-    # @param [Time/Integer] time the time to generate an OTP for
-    # @option [Boolean] padding (true) Issue the number as a 0 padded string
-    def at(time, padding=true)
-      unless time.class == Time
-        time = Time.at(time.to_i)
-      end
-      generate_otp(timecode(time), padding)
+    # @param time [Time/Integer] the time to generate an OTP for, integer unix timestamp or Time object
+    def at(time)
+      generate_otp(timecode(time))
     end
 
     # Generate the current time OTP
     # @return [Integer] the OTP as an integer
-    def now(padding=true)
-      generate_otp(timecode(Time.now), padding)
+    def now
+      generate_otp(timecode(Time.now))
     end
 
     # Verifies the OTP passed in against the current time OTP
-    # @param [String/Integer] otp the OTP to check against
-    def verify(otp, time = Time.now)
-      super(otp, self.at(time))
-    end
+    # and adjacent intervals up to +drift+.  Excludes OTPs
+    # from `after` and earlier.  Returns time value of
+    # matching OTP code for use in subsequent call.
+    # @param otp [String] the one time password to verify
+    # @param drift_behind [Integer] how many seconds to look back
+    # @param drift_ahead [Integer] how many seconds to look ahead
+    # @param after [Integer] prevent token reuse, last login timestamp
+    # @param at [Time] time at which to generate and verify a particular
+    #   otp. default Time.now
+    # @return [Integer, nil] the last successful timestamp
+    #   interval
+    def verify(otp, drift_ahead: 0, drift_behind: 0, after: nil, at: Time.now)
+      timecodes = get_timecodes(at, drift_behind, drift_ahead)
 
-    # Verifies the OTP passed in against the current time OTP
-    # and adjacent intervals up to +drift+.
-    # @param [String] otp the OTP to check against
-    # @param [Integer] drift the number of seconds that the client
-    #     and server are allowed to drift apart
-    def verify_with_drift(otp, drift, time = Time.now)
-      time = time.to_i
-      times = (time-drift..time+drift).step(interval).to_a
-      times << time + drift if times.last < time + drift
-      times.any? { |ti| verify(otp, ti) }
+      timecodes = timecodes.select { |t| t > timecode(after) } if after
+
+      result = nil
+      timecodes.each do |t|
+        result = t * interval if super(otp, generate_otp(t))
+      end
+      result
     end
 
     # Returns the provisioning URI for the OTP
     # This can then be encoded in a QR Code and used
     # to provision the Google Authenticator app
     # @param [String] name of the account
-    # @return [String] provisioning uri
+    # @return [String] provisioning URI
     def provisioning_uri(name)
-      encode_params("otpauth://totp/#{URI.encode(name)}",
-                    :secret => secret, :period => (interval==30 ? nil : interval), :issuer => issuer)
+      OTP::URI.new(self, account_name: name).to_s
     end
 
     private
 
-    def timecode(time)
-      time.utc.to_i / interval
+    # Get back an array of timecodes for a period
+    def get_timecodes(at, drift_behind, drift_ahead)
+      now = timeint(at)
+      timecode_start = timecode(now - drift_behind)
+      timecode_end = timecode(now + drift_ahead)
+      (timecode_start..timecode_end).step(1).to_a
+    end
+
+    # Ensure UTC int
+    def timeint(time)
+      return time.to_i unless time.class == Time
+
+      time.utc.to_i
     end
 
+    def timecode(time)
+      timeint(time) / interval
+    end
   end
 end

data/lib/rotp/version.rb

@@ -1,3 +1,3 @@
 module ROTP
-  VERSION = "2.1.1"
+  VERSION = '6.2.2'.freeze
 end

data/lib/rotp.rb

@@ -1,11 +1,10 @@
-require 'cgi'
-require 'uri'
 require 'openssl'
+require 'erb'
 require 'rotp/base32'
 require 'rotp/otp'
+require 'rotp/otp/uri'
 require 'rotp/hotp'
 require 'rotp/totp'
 
-
 module ROTP
 end

data/rotp.gemspec

@@ -1,27 +1,24 @@
-# -*- encoding: utf-8 -*-
-$:.push File.expand_path("../lib", __FILE__)
-require "rotp/version"
+require './lib/rotp/version'
 
 Gem::Specification.new do |s|
-  s.name        = "rotp"
+  s.name        = 'rotp'
   s.version     = ROTP::VERSION
   s.platform    = Gem::Platform::RUBY
-  s.license     = "MIT"
-  s.authors     = ["Mark Percival"]
-  s.email       = ["mark@markpercival.us"]
-  s.homepage    = "http://github.com/mdp/rotp"
-  s.summary     = %q{A Ruby library for generating and verifying one time passwords}
-  s.description = %q{Works for both HOTP and TOTP, and includes QR Code provisioning}
-
-  s.rubyforge_project = "rotp"
+  s.required_ruby_version = '>= 2.3'
+  s.license     = 'MIT'
+  s.authors     = ['Mark Percival']
+  s.email       = ['mark@markpercival.us']
+  s.homepage    = 'https://github.com/mdp/rotp'
+  s.summary     = 'A Ruby library for generating and verifying one time passwords'
+  s.description = 'Works for both HOTP and TOTP, and includes QR Code provisioning'
 
   s.files         = `git ls-files`.split("\n")
   s.test_files    = `git ls-files -- {test,spec,features}/*`.split("\n")
-  s.executables   = `git ls-files -- bin/*`.split("\n").map{ |f| File.basename(f) }
-  s.require_paths = ["lib"]
+  s.executables   = `git ls-files -- bin/*`.split("\n").map { |f| File.basename(f) }
+  s.require_paths = ['lib']
 
-  s.add_development_dependency 'guard-rspec', '~> 4.5'
-  s.add_development_dependency 'rake', '~> 10.4'
-  s.add_development_dependency 'rspec', '~> 3.1'
-  s.add_development_dependency 'timecop', '~> 0.7'
+  s.add_development_dependency "rake", "~> 13.0"
+  s.add_development_dependency 'rspec', '~> 3.5'
+  s.add_development_dependency 'simplecov', '~> 0.12'
+  s.add_development_dependency 'timecop', '~> 0.8'
 end

data/spec/lib/rotp/arguments_spec.rb

@@ -24,7 +24,7 @@ RSpec.describe ROTP::Arguments do
   end
 
   context 'unknown arguments' do
-    let(:argv) { %w(--does-not-exist -xyz) }
+    let(:argv) { %w[--does-not-exist -xyz] }
 
     describe '#options' do
       it 'is in help mode' do
@@ -48,7 +48,7 @@ RSpec.describe ROTP::Arguments do
   end
 
   context 'asking for help' do
-    let(:argv) { %w(--help) }
+    let(:argv) { %w[--help] }
 
     describe '#options' do
       it 'is in help mode' do
@@ -58,7 +58,7 @@ RSpec.describe ROTP::Arguments do
   end
 
   context 'generating a counter based secret' do
-    let(:argv) { %w(--hmac --secret s3same) }
+    let(:argv) { %w[--hmac --secret s3same] }
 
     describe '#options' do
       it 'is in hmac mode' do
@@ -71,8 +71,22 @@ RSpec.describe ROTP::Arguments do
     end
   end
 
+  context 'generating a counter based secret' do
+    let(:argv) { %w[--time --secret s3same] }
+
+    describe '#options' do
+      it 'is in hmac mode' do
+        expect(options.mode).to eq :time
+      end
+
+      it 'knows the secret' do
+        expect(options.secret).to eq 's3same'
+      end
+    end
+  end
+
   context 'generating a time based secret' do
-    let(:argv) { %w(--secret s3same) }
+    let(:argv) { %w[--secret s3same] }
 
     describe '#options' do
       it 'is in time mode' do
@@ -84,5 +98,4 @@ RSpec.describe ROTP::Arguments do
       end
     end
   end
-
 end