Generating TOTP Codes

[excel]

FYI:

I have been looking for a simple program to generate TOTP codes that is not tied to other functions or subject to 3rd parties.

I ran across a github recently for a simple program to generate TOTP codes:

GitHub - susam/mintotp: Minimal TOTP generator in 20 lines of Python

Minimal TOTP generator in 20 lines of Python. Contribute to susam/mintotp development by creating an account on GitHub.

github.com

There is also one in golang, which I found easier to compile:

GitHub - ashraful-islam/gototp: A simple TOTP generator written in Golang

A simple TOTP generator written in Golang. Contribute to ashraful-islam/gototp development by creating an account on GitHub.

github.com

I checked a TOTP key and the codes matched the ones generated by keepassxc.

I have not decided where to store the keys - perhaps in a password vault or other separate area. keepassxc works but I find the interface unintuitive.

 

[xplora1a]

The popular and well used library for Python TOTP is https://github.com/pyauth/pyotp

 

[PHolder]

When Steve was answering the question about TOTP repetition, I used ChatGPT to throw together a quick stats tracker. This is the majority of the ChatGPT generated TOTP calculation code, as tweaked by me to actually work right. The basics of TOTP are just an assemblage of crypto primitives and URL encoding.

import java.security.InvalidKeyException;
import java.security.NoSuchAlgorithmException;
import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import org.apache.commons.codec.binary.Base32;

// Most of this code was from ChatGPT
final class TOTPGenerator
{
  private static final String HMAC_ALGORITHM = "HmacSHA1";
  private static final int DIGITS = 6;
  private static final long TIME_STEP = 30L;  // TOTP time step in seconds
  private final static Base32 base32Codec = new Base32();  // Apache Commons utility

  private  final String totpSecret;

  public TOTPGenerator(final String totpSecret)
  {
    this.totpSecret = totpSecret;
  }

  public String generate(final long totp_time)
  {
    try
    {
      final String totp = generateTOTP(totpSecret, totp_time);
      return totp;
    }
    catch (final InvalidKeyException | NoSuchAlgorithmException e)
    {
      throw new IllegalStateException(e);
    }
  }

  public static String generateTOTP(final String secret, final long inputTimeCounter)
      throws NoSuchAlgorithmException, InvalidKeyException
  {
    long timeCounter = inputTimeCounter;
    final byte[] secretKey = base32Codec.decode(secret);
    final byte[] timeCounterBytes = new byte[8];
    for (int i = 7; i >= 0; i--)
    {
      timeCounterBytes[i] = (byte) (timeCounter & 0xFF);
      timeCounter >>>= 8;
    }

    final Mac mac = Mac.getInstance(HMAC_ALGORITHM);
    final SecretKeySpec keySpec = new SecretKeySpec(secretKey, HMAC_ALGORITHM);
    mac.init(keySpec);
    final byte[] hash = mac.doFinal(timeCounterBytes);

    final int offset = hash[hash.length - 1] & 0x0F;
    int code = ((hash[offset] & 0x7F) << 24)    | ((hash[offset + 1] & 0xFF) << 16)
                   | ((hash[offset + 2] & 0xFF) << 8) | (hash[offset + 3] & 0xFF);

    code %= (int) Math.pow(10, DIGITS);
    return String.format("%0" + DIGITS + "d", code);
  }
}