If you don’t know what multi-factor authentication is please read this before continuing. I am going to assume you understand the security concepts mentioned in this post…
In plain English: two-factor authentication is something you know (your password) and something you have (your token). I will focus on the token in this post. Apps like Google Authenticator and Authy generate one-time time-based tokens, or passwords. They generate them by hashing a shared secret combined with the current time. By default, the resulting token changes every 30 seconds giving the user a short window to authenticate to a service.
You can set it up with GitHub for example; in your user security settings you enable 2-factor authentication, GitHub then generates the shared secret for you which you import into the authenticator app. From then on when you login you must provide your password plus the generated token. Because both you and GitHub have access to the shared secret, both can generate the same token at the same time. If the user provided and the GitHub generated tokens match, the authentication succeeds and you’re logged in.
So what is this post about anyways? What I set-out to do today was to generate the one-time tokens programmatically from a C++ program. I wanted to test this by feeding the same shared secret to Authy and see that both my program and Authy generate the same tokens. With this working I, or you the reader, could add two-factor authentication to our applications, which is cool 🙂
Initially I started reading about the algorithm used to generate the tokens: Time-based One-time Password Algorithm. I sure as hell didn’t want to implement all of this from scratch, so I started looking for an OpenSSL implementation. During my search I came across a free (and available on Mac and Linux) framework to do what I wanted: OATH Toolkit. Once I started reading the documentation the rest fell in place very easily. I generated a dummy shared secret: 00112233445566778899 and fed it to Authy as well as my program (Google Authenticator requires it to be base32 encoded).
Below are screenshots of Authy and my program generating the same tokens. And of course the code!
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 |
#include <iostream> #include <thread> #include <cstdlib> #include <liboath/oath.h> using namespace std; int main(int argc, char** argv) { auto result = oath_init(); if(result != OATH_OK) { cerr << oath_strerror(result) << endl; return -1; } const char secret[] = "00112233445566778899"; const auto time_step = OATH_TOTP_DEFAULT_TIME_STEP_SIZE; const auto digits = 6; while(true) { auto t = time(NULL); auto left = time_step - (t % time_step); char otp[digits + 1] = {}; result = oath_totp_generate( secret, sizeof(secret), t, time_step, OATH_TOTP_DEFAULT_START_TIME, digits, otp); if(result != OATH_OK) { cerr << oath_strerror(result) << endl; return -1; } cout << "OTP: " << otp << " (" << left << ") \r"; cout.flush(); this_thread::sleep_for(1s); } oath_done(); return 1; } |
Hi, you may want to provide a parameter to specify the time window size (30 and 60 second windows are common).