I’ve recently setup 2-factor authentication on my Google account. The new 2nd factor or “thing you have” is a smartphone application which generates 6 digit one-time passwords.
I was a bit surprised when I stumbled on this article Two Factor SSH with Google Authenticator. Turns out the algorithm used to generate the OTPs is an open standard. When you set-up an account in the smartphone app you are storing a key that’s used to create a HMAC of the current time.
You can read the specifics of the algorithm in the TOTP RFC Draft. I really like the idea that you can use the smartphone app to generate OTPs for your own application. I’ve implemented the algorithm in javascript on jsfiddle.  Javascript is nice and readable, but please don’t implement your verification client side! 🙂
History
- 2012-Sept-6: jsSHA moved location
- 2012-Sept-12: Something suspect about the way I’m converting BASE32 to bytes. Changed it to grab full bytes from the binary string, and ignore anything left over.
- 2014-April-22: Github not a CDN anymore.. 🙂 Moved references to bootstrap and jsSHA
Post a Comment